We observed that passing certain crafted strings to zoneinfo.ZoneInfo() can raise an unhandled OSError instead of being converted into TimeZoneNotFoundError.
Current code:
def to_tzobj(self, tzstr):
if tzstr in (None, ""):
raise TimeZoneNotFoundError
try:
return zoneinfo.ZoneInfo(tzstr)
except zoneinfo.ZoneInfoNotFoundError as err:
raise TimeZoneNotFoundError from errExample malicious input that triggered this:
"${(new java.io.BufferedReader(new java.io.InputStreamReader(((new java.lang.ProcessBuilder(new java.lang.String[]{"timeout","0"})).start()).getInputStream()))).readLine()}${(new java.io.BufferedReader(new java.io.InputStreamReader(((new java.lang.ProcessBuilder(new java.lang.String[]{"sleep","0"})).start()).getInputStream()))).readLine()}"
Backend context:
class ZoneInfoBackend(TimeZoneBackend):
utc_tzobj = zoneinfo.ZoneInfo("UTC")
all_tzstrs = zoneinfo.available_timezones()
base_tzstrs = zoneinfo.available_timezones()
all_tzstrs.discard("Factory")
base_tzstrs.discard("Factory")Question:
Should to_tzobj() first validate that tzstr exists in all_tzstrs before calling zoneinfo.ZoneInfo() to ensure consistent error handling and avoid unexpected exceptions?
We observed that passing certain crafted strings to
zoneinfo.ZoneInfo()can raise an unhandledOSErrorinstead of being converted intoTimeZoneNotFoundError.Current code:
Example malicious input that triggered this:
Backend context:
Question:
Should
to_tzobj()first validate thattzstrexists inall_tzstrsbefore callingzoneinfo.ZoneInfo()to ensure consistent error handling and avoid unexpected exceptions?