From 9febc2b238e1e322dce1f94ecbed46d595893b52 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Sat, 28 May 2016 11:03:35 +0200
Subject: accept only the expected UTC timezones in date parsing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HTTP/1.1 hardcodes GMT (RFC 7231 §7.1.1.1) and what is good enough for the
internet must be good enough for us™ as we reuse the implementation
internally to parse (most) dates we encounter in various places like the
Release files with their Date and Valid-Until header fields.

Implementing a fully timezone aware parser just feels too hard for no
effective benefit as it would take 5+ years (= until LTS's are out of
fashion) until a repository could use non-UTC dates and expect it to
work. Not counting non-apt implementations which might or might not
only want to encounter UTC here as well.

As a bonus, this eliminates the use of an instance of setlocale in
libapt.

Closes: 819697
---
 test/integration/test-apt-update-ims |  4 ++--
 test/libapt/strutil_test.cc          | 38 ++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)

(limited to 'test')

diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
index e1ffd5240..f118f7c11 100755
--- a/test/integration/test-apt-update-ims
+++ b/test/integration/test-apt-update-ims
@@ -95,9 +95,9 @@ runtest 'warning'
 
 # make the release file old
 find aptarchive -name '*Release' -exec sed -i \
-	-e "s#^Date: .*\$#Date: $(date -d '-2 weeks' '+%a, %d %b %Y %H:%M:%S %Z')#" \
+	-e "s#^Date: .*\$#Date: $(date -ud '-2 weeks' '+%a, %d %b %Y %H:%M:%S %Z')#" \
 	-e '/^Valid-Until: / d' -e "/^Date: / a\
-Valid-Until: $(date -d '-1 weeks' '+%a, %d %b %Y %H:%M:%S %Z')" '{}' \;
+Valid-Until: $(date -ud '-1 weeks' '+%a, %d %b %Y %H:%M:%S %Z')" '{}' \;
 signreleasefiles
 
 msgmsg 'expired InRelease'
diff --git a/test/libapt/strutil_test.cc b/test/libapt/strutil_test.cc
index 8947aea59..b7ba816ee 100644
--- a/test/libapt/strutil_test.cc
+++ b/test/libapt/strutil_test.cc
@@ -246,3 +246,41 @@ TEST(StrUtilTest,QuoteString)
    EXPECT_EQ("%45ltvill%65%2d%45rbach", QuoteString("Eltville-Erbach", "E-Ae"));
    EXPECT_EQ("Eltville-Erbach", DeQuoteString(QuoteString("Eltville-Erbach", "")));
 }
+
+TEST(StrUtilTest,RFC1123StrToTime)
+{
+   {
+      time_t t;
+      EXPECT_TRUE(RFC1123StrToTime("Sun, 06 Nov 1994 08:49:37 GMT", t));
+      EXPECT_EQ(784111777, t);
+   } {
+      time_t t;
+      EXPECT_TRUE(RFC1123StrToTime("Sun, 06 Nov 1994 08:49:37 UTC", t));
+      EXPECT_EQ(784111777, t);
+   } {
+      time_t t;
+      EXPECT_TRUE(RFC1123StrToTime("Sun, 06 Nov 1994 08:49:37 -0000", t));
+      EXPECT_EQ(784111777, t);
+   } {
+      time_t t;
+      EXPECT_TRUE(RFC1123StrToTime("Sun, 06 Nov 1994 08:49:37 +0000", t));
+      EXPECT_EQ(784111777, t);
+   } {
+      time_t t;
+      EXPECT_TRUE(RFC1123StrToTime("Sunday, 06-Nov-94 08:49:37 GMT", t));
+      EXPECT_EQ(784111777, t);
+   } {
+      time_t t;
+      EXPECT_TRUE(RFC1123StrToTime("Sun Nov  6 08:49:37 1994", t));
+      EXPECT_EQ(784111777, t);
+   }
+   time_t t;
+   EXPECT_FALSE(RFC1123StrToTime("Sun, 06 Nov 1994 08:49:37", t));
+   EXPECT_FALSE(RFC1123StrToTime("Sun, 06 Nov 1994 GMT", t));
+   EXPECT_FALSE(RFC1123StrToTime("Sonntag, 06 Nov 1994 08:49:37 GMT", t));
+   EXPECT_FALSE(RFC1123StrToTime("domingo Nov 6 08:49:37 1994", t));
+   EXPECT_FALSE(RFC1123StrToTime("Sunday, 06-Nov-94 08:49:37 GMT+1", t));
+   EXPECT_FALSE(RFC1123StrToTime("Sunday, 06-Nov-94 08:49:37 EDT", t));
+   EXPECT_FALSE(RFC1123StrToTime("Sunday, 06-Nov-94 08:49:37 -0100", t));
+   EXPECT_FALSE(RFC1123StrToTime("Sunday, 06-Nov-94 08:49:37 -0.1", t));
+}
-- 
cgit v1.2.3