alhudz opened a new pull request, #1837:
URL: https://github.com/apache/commons-lang/pull/1837
`FastDateParser` throws `IllegalArgumentException` instead of
`ParseException` when a pattern with a week year (`Y`) meets an out-of-range
ISO day number of week (`u`):
```java
FastDateFormat.getInstance("YYYY-'W'ww-u", TimeZones.GMT,
Locale.US).parse("2025-W01-8");
// java.lang.IllegalArgumentException: invalid dayOfWeek: 9
new SimpleDateFormat("YYYY-'W'ww-u", Locale.US).parse("2025-W01-8");
// Mon Jan 06 00:00:00 GMT 2025 (lenient: the overflow is folded into the
week number)
```
`parse(String, ParsePosition)` throws the same exception instead of
returning `null`, so a caller that catches `ParseException`, or checks the
`ParsePosition`, is not protected against untrusted input such as
`"2025-W01-123"`.
Cause: `WeekDateRecorder.applyWeekDate` hands the parsed day of week
straight to `Calendar.setWeekDate`. `GregorianCalendar.setWeekDate` (and the
Japanese imperial calendar's) rejects a day of week outside `SUNDAY..SATURDAY`
even when the calendar is lenient. `java.text.CalendarBuilder.establish`, which
`SimpleDateFormat` uses for the same step, first folds the overflow of an
out-of-range `u` into the week number and only then calls `setWeekDate`. The
`u` strategy also mapped every value with `iValue == 7 ? SUNDAY : iValue + 1`,
so on the plain calendar-year path an out-of-range value already diverged from
`SimpleDateFormat` (`"u"` / `"8"` gave Monday where `SimpleDateFormat` gives
Sunday).
Fix: mirror `CalendarBuilder` inside `FastDateParser`. The `u` strategy
converts only `1..7` to `Calendar` numbering and keeps an out-of-range value
raw for the lenient calendar to adjust, and `applyWeekDate` normalises an
out-of-range day of week into the week count before `setWeekDate` when the
target calendar is lenient. In-range values and non-lenient calendars are
unchanged. `FastDateParserTest.testWeekYearParsingOutOfRangeDayOfWeek` compares
both `parse` overloads with `SimpleDateFormat` for in-range and out-of-range
`u` in week-year and calendar-year patterns; it fails on master with the
`IllegalArgumentException` above and passes with this change. `setWeekDate` is
the only `Calendar` call in the library that validates in lenient mode, and
Commons Text has no copy of this class.
Thanks for your contribution to [Apache
Commons](https://commons.apache.org/)! Your help is appreciated!
Before you push a pull request, review this list:
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
- [x] Read the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) if you use
Artificial Intelligence (AI).
- [x] I used AI to create any part of, or all of, this pull request. Which
AI tool was used to create this pull request, and to what extent did it
contribute? Claude Code (Anthropic) found the defect by differential fuzzing of
`FastDateFormat.parse` against `SimpleDateFormat` and drafted the fix, the test
and this description; I reviewed the change and ran the build before submitting.
- [x] Run a successful build using the default
[Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command
line by itself. The default goal steps (`clean verify` with the full test
suite, RAT, Checkstyle, japicmp, SpotBugs, PMD and Javadoc with
`-Ddoclint=all`) are green on JDK 21, and the `time` package tests are also
green on JDK 27.
- [x] Write unit tests that match behavioral changes, where the tests fail
if the changes to the runtime are not applied. This may not always be possible,
but it is a best practice.
- [x] Write a pull request description that is detailed enough to understand
what the pull request does, how, and why.
- [x] Each commit in the pull request should have a meaningful subject line
and body. Note that a maintainer may squash commits during the merge process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
