Skip to content

🛡️ Shield: Robust numeric timestamp parsing#720

Merged
fderuiter merged 3 commits intomainfrom
shield-fix-datetime-parsing-13020613294477168326
Feb 27, 2026
Merged

🛡️ Shield: Robust numeric timestamp parsing#720
fderuiter merged 3 commits intomainfrom
shield-fix-datetime-parsing-13020613294477168326

Conversation

@fderuiter
Copy link
Owner

🛑 Vulnerability: The parse_datetime validator implicitly assumed input timestamps would be strings (ISO format) or None. However, numeric timestamps (int/float seconds since epoch) are a valid data type in Python and potentially from API responses, but were being returned as-is (raw numbers) instead of converted to datetime objects. This bypasses type safety and could cause downstream AttributeErrors when methods like .strftime() are called on an integer.

🛡️ Defense: Updated parse_datetime in src/imednet/utils/validators.py to explicitly detect int and float types and convert them to timezone-aware UTC datetime objects using datetime.fromtimestamp(v, tz=timezone.utc).

🔬 Verification: Created tests/unit/test_parse_datetime_robustness.py which validates:

  • Integer timestamps (e.g. 1609459200) -> UTC datetime
  • Float timestamps (e.g. 1609459200.5) -> UTC datetime with microseconds
  • Negative timestamps (historic dates) -> UTC datetime
  • Zero/Epoch (legacy behavior) -> Returns sentinel date due to falsy check

📊 Impact: Fixes a potential "sad path" crash where numeric timestamps would be passed through as integers, ensuring 100% of outputs from parse_datetime are valid datetime objects (or the sentinel).


PR created automatically by Jules for task 13020613294477168326 started by @fderuiter

test(utils): add tests for numeric timestamp parsing
docs(shield): journal numeric timestamp fix

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
@google-labs-jules
Copy link
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

fderuiter and others added 2 commits February 27, 2026 19:01
test(utils): add tests for numeric timestamp parsing
docs(shield): journal numeric timestamp fix

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
test(utils): add tests for numeric timestamp parsing
docs(shield): journal numeric timestamp fix

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
@fderuiter fderuiter marked this pull request as ready for review February 27, 2026 19:34
@fderuiter fderuiter merged commit 638199c into main Feb 27, 2026
13 checks passed
@fderuiter fderuiter deleted the shield-fix-datetime-parsing-13020613294477168326 branch February 27, 2026 19:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant