generate_signed_post_policy_v4() improperly handles expiration timestamps with tzinfo=None #244
Labels
api: storage
Issues related to the googleapis/python-storage API.
priority: p2
Moderately-important priority. Fix may not be included in next release.
type: bug
Error or flaw in code with unintended results or allowing sub-optimal usage patterns.
The
generate_signed_post_policy_v4()
workflow, usingget_expiration_seconds_v4()
(get_expiration_seconds_v2()
may also be affected) improperly calculates the expiration seconds if a datetime without tzinfo is used.For instance, Python's
datetime.datetime.now()
produces a datetime withtzinfo=None
, but in local time. Theget_expiration_seconds_v4()
method replaces that "None" timezone with a UTC tzinfo, which results in an inaccurate timestamp that was generated for local time but is now presented as UTC.There is no way to safely handle
tzinfo=None
user input in Python. The library should either document thattzinfo=None
will be treated as either local time or UTC (current behavior, UTC) or else it should reject timestamps without tzinfo for safety.The system test
TestV4POSTPolicies.test_get_signed_policy_v4()
will also fail when run in a timezone west of the equator and should be modified along with the above code. Warning: it is possible Kokoro is not running in a timezone west of the equator and will not manifest this error.The text was updated successfully, but these errors were encountered: