From c89a5338f3ebf5c8bbf5cd867804496fa4962c75 Mon Sep 17 00:00:00 2001 From: tonghuaroot Date: Fri, 26 Jun 2026 12:50:26 +0800 Subject: [PATCH 1/4] gh-152246: Reject a POSIX TZ Mm.w.d rule with a non-period separator in pure-Python zoneinfo --- Lib/test/test_zoneinfo/test_zoneinfo.py | 5 +++++ Lib/zoneinfo/_zoneinfo.py | 2 +- .../Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst | 6 ++++++ 3 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst diff --git a/Lib/test/test_zoneinfo/test_zoneinfo.py b/Lib/test/test_zoneinfo/test_zoneinfo.py index 7502b120825fbc..54a02dfb91e793 100644 --- a/Lib/test/test_zoneinfo/test_zoneinfo.py +++ b/Lib/test/test_zoneinfo/test_zoneinfo.py @@ -1184,6 +1184,11 @@ def test_invalid_tzstr(self): # Invalid weekday "AAA4BBB,M1.1.7/2,M2.1.1/2", "AAA4BBB,M1.1.1/2,M2.1.7/2", + # Invalid Mm.w.d separator (must be a literal '.') + "AAA4BBB,M3.2X0,M11.1.0", + "AAA4BBB,M3.2.0,M11.1X0", + "AAA4BBB,M3.2-0,M11.1.0/3", + "AAA4BBB,M3.2.0/2,M11.1:0", # Invalid numeric offset "AAA4BBB,-1/2,20/2", "AAA4BBB,1/2,-1/2", diff --git a/Lib/zoneinfo/_zoneinfo.py b/Lib/zoneinfo/_zoneinfo.py index 7063eb6a9025ac..3903d57d55417e 100644 --- a/Lib/zoneinfo/_zoneinfo.py +++ b/Lib/zoneinfo/_zoneinfo.py @@ -707,7 +707,7 @@ def _parse_dst_start_end(dststr): type = date[:1] if type == "M": n_is_julian = False - m = re.fullmatch(r"M(\d{1,2})\.(\d).(\d)", date, re.ASCII) + m = re.fullmatch(r"M(\d{1,2})\.(\d)\.(\d)", date, re.ASCII) if m is None: raise ValueError(f"Invalid dst start/end date: {dststr}") date_offset = tuple(map(int, m.groups())) diff --git a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst new file mode 100644 index 00000000000000..3e42c388f0432d --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst @@ -0,0 +1,6 @@ +Fixed a parity bug in the pure-Python :mod:`zoneinfo` implementation, which +accepted a POSIX TZ ``Mm.w.d`` transition rule whose third separator was not a +period (for example ``M3.2X0``). Only the first period was escaped in the +regular expression, so the third one matched any character. Such a string is +invalid per POSIX and is already rejected by the C accelerator. Patch by +tonghuaroot. \ No newline at end of file From 5c545bdff78fc7bcd2ac969ccfeee1b28304ed13 Mon Sep 17 00:00:00 2001 From: tonghuaroot Date: Fri, 26 Jun 2026 12:54:39 +0800 Subject: [PATCH 2/4] Add trailing newline to NEWS entry --- .../next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst index 3e42c388f0432d..e1780a4c265ad8 100644 --- a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst +++ b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst @@ -3,4 +3,4 @@ accepted a POSIX TZ ``Mm.w.d`` transition rule whose third separator was not a period (for example ``M3.2X0``). Only the first period was escaped in the regular expression, so the third one matched any character. Such a string is invalid per POSIX and is already rejected by the C accelerator. Patch by -tonghuaroot. \ No newline at end of file +tonghuaroot. From d3adcf75bef22c39e8b29b7e74188bb3fe16e040 Mon Sep 17 00:00:00 2001 From: tonghuaroot Date: Fri, 26 Jun 2026 12:59:57 +0800 Subject: [PATCH 3/4] Simplify NEWS entry --- .../2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst index e1780a4c265ad8..1b1c94fe28b1b6 100644 --- a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst +++ b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst @@ -1,6 +1,3 @@ -Fixed a parity bug in the pure-Python :mod:`zoneinfo` implementation, which -accepted a POSIX TZ ``Mm.w.d`` transition rule whose third separator was not a -period (for example ``M3.2X0``). Only the first period was escaped in the -regular expression, so the third one matched any character. Such a string is -invalid per POSIX and is already rejected by the C accelerator. Patch by -tonghuaroot. +Fix the pure-Python :mod:`zoneinfo` parser accepting a POSIX TZ ``Mm.w.d`` +transition rule with a non-period separator (for example ``M3.2X0``), which +the C implementation already rejects. Patch by tonghuaroot. From 72f1374910b3b2491ed37ef534d8066d7782bbc9 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Fri, 26 Jun 2026 11:37:12 +0100 Subject: [PATCH 4/4] Apply suggestions from code review Co-authored-by: Stan Ulbrych --- Lib/test/test_zoneinfo/test_zoneinfo.py | 2 +- .../Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_zoneinfo/test_zoneinfo.py b/Lib/test/test_zoneinfo/test_zoneinfo.py index 54a02dfb91e793..d4d57b8f727584 100644 --- a/Lib/test/test_zoneinfo/test_zoneinfo.py +++ b/Lib/test/test_zoneinfo/test_zoneinfo.py @@ -1184,7 +1184,7 @@ def test_invalid_tzstr(self): # Invalid weekday "AAA4BBB,M1.1.7/2,M2.1.1/2", "AAA4BBB,M1.1.1/2,M2.1.7/2", - # Invalid Mm.w.d separator (must be a literal '.') + # Invalid Mm.w.d separator "AAA4BBB,M3.2X0,M11.1.0", "AAA4BBB,M3.2.0,M11.1X0", "AAA4BBB,M3.2-0,M11.1.0/3", diff --git a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst index 1b1c94fe28b1b6..0858199a9fa279 100644 --- a/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst +++ b/Misc/NEWS.d/next/Library/2026-06-26-12-50-26.gh-issue-152246.MfXMd1.rst @@ -1,3 +1,2 @@ -Fix the pure-Python :mod:`zoneinfo` parser accepting a POSIX TZ ``Mm.w.d`` -transition rule with a non-period separator (for example ``M3.2X0``), which -the C implementation already rejects. Patch by tonghuaroot. +Fix the pure-Python :mod:`zoneinfo` parser accepting an invalid POSIX TZ +transition rule with a non-period separator. Patch by tonghuaroot.