From 75749fc673f74eaf3f5fe318237161633679c3eb Mon Sep 17 00:00:00 2001 From: Manish Goregaokar Date: Tue, 10 Jun 2025 11:30:26 -0700 Subject: [PATCH 1/2] Handle unknown timezone identifiers in FsTzdbProvider --- src/tzdb.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/tzdb.rs b/src/tzdb.rs index d8b3398cb..521b1a761 100644 --- a/src/tzdb.rs +++ b/src/tzdb.rs @@ -167,12 +167,19 @@ impl Tzif { #[cfg(target_family = "unix")] pub fn read_tzif(identifier: &str) -> TemporalResult { + // Protect from path traversal attacks + if (identifier.starts_with('/') || identifier.contains('.')) { + return Err(TemporalError::range("Ill-formed timezone identifier")); + } let mut path = PathBuf::from(ZONEINFO_DIR); path.push(identifier); Self::from_path(&path) } pub fn from_path(path: &Path) -> TemporalResult { + if !path.exists() { + return Err(TemporalError::range("Unknown timezone identifier")); + } tzif::parse_tzif_file(path) .map(Into::into) .map_err(|e| TemporalError::general(e.to_string())) From 8c94f5d0104f99533c10dbe1f6296a3f06a9ad4f Mon Sep 17 00:00:00 2001 From: Manish Goregaokar Date: Sat, 21 Jun 2025 06:34:19 -0700 Subject: [PATCH 2/2] lint --- src/tzdb.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/tzdb.rs b/src/tzdb.rs index 521b1a761..4fcc3ccf9 100644 --- a/src/tzdb.rs +++ b/src/tzdb.rs @@ -168,8 +168,8 @@ impl Tzif { #[cfg(target_family = "unix")] pub fn read_tzif(identifier: &str) -> TemporalResult { // Protect from path traversal attacks - if (identifier.starts_with('/') || identifier.contains('.')) { - return Err(TemporalError::range("Ill-formed timezone identifier")); + if identifier.starts_with('/') || identifier.contains('.') { + return Err(TemporalError::range().with_message("Ill-formed timezone identifier")); } let mut path = PathBuf::from(ZONEINFO_DIR); path.push(identifier); @@ -178,7 +178,7 @@ impl Tzif { pub fn from_path(path: &Path) -> TemporalResult { if !path.exists() { - return Err(TemporalError::range("Unknown timezone identifier")); + return Err(TemporalError::range().with_message("Unknown timezone identifier")); } tzif::parse_tzif_file(path) .map(Into::into)