fix: restrict numeric date fields to ASCII digits CVE-2026-60074 - #54
Open
robrwo wants to merge 1 commit into
Open
fix: restrict numeric date fields to ASCII digits CVE-2026-60074#54robrwo wants to merge 1 commit into
robrwo wants to merge 1 commit into
Conversation
The parse regexes capture year, month and day with the \d shorthand,
which on a character string matches the whole Unicode decimal digit
property \p{Nd} and not just [0-9]. Date::Manip::Base::check validates
the captured fields with numeric comparisons alone, and _parse_check
stores the numified fields, so a field whose leading characters are
ASCII digits numifies to an in-range prefix and satisfies every test.
With U+0664 ARABIC-INDIC DIGIT FOUR as the final character of the year,
ParseDate("202\x{664}-03-08") returns 0202030800:00:00; a non-ASCII
digit in the month or day field shifts those fields the same way
("2026-1\x{662}-08" returns January, "2026-03-1\x{665}" returns the
1st), and one in a fractional minute field drops the fraction.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check validates the captured fields with numeric comparisons alone, and _parse_check stores the numified fields, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test. With U+0664 ARABIC-INDIC DIGIT FOUR as the final character of the year, ParseDate("202\x{664}-03-08") returns 0202030800:00:00; a non-ASCII digit in the month or day field shifts those fields the same way ("2026-1\x{662}-08" returns January, "2026-03-1\x{665}" returns the 1st), and one in a fractional minute field drops the fraction.