Skip to content

Household timezone is unvalidated; an invalid IANA zone bricks all scheduling #63

Description

@tkowalczyk

Summary

UpdateHouseholdInput.timezone is z.string() with no IANA check. The stored value feeds SchedulerDO.scheduleFromSource(…, timezone, …); Intl.DateTimeFormat(…,{timeZone:"Mars/Olympus"}) throws RangeError, so one bad admin submit breaks alarm computation for every source.

Evidence

  • packages/data-ops/src/zod-schema/household.ts:11-13timezone: z.string().
  • apps/user-application/src/core/functions/household-settings.ts:21-31 — stores it as-is.
  • apps/data-service/src/domain/waste-collection-handler.ts:67-94 / birthday-handler.ts:19-46Intl.DateTimeFormat({timeZone}) throws on an invalid zone.

Proposed failing test (TDD)

packages/data-ops/src/zod-schema/household.test.ts"rejects a non-IANA timezone": UpdateHouseholdInput.safeParse({timezone:"Not/AZone"})success === false. Currently true.

Fix direction

.refine(tz => Intl.supportedValuesOf("timeZone").includes(tz)).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    audit/2026-06Filed from June 2026 deep auditbugSomething isn't workingseverity/mediumMedium severity security or reliability risk

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions