Skip to content

generate_signed_post_policy_v4() improperly handles expiration timestamps with tzinfo=None #244

@andrewsg

Description

@andrewsg

The generate_signed_post_policy_v4() workflow, using get_expiration_seconds_v4() (get_expiration_seconds_v2() may also be affected) improperly calculates the expiration seconds if a datetime without tzinfo is used.

For instance, Python's datetime.datetime.now() produces a datetime with tzinfo=None, but in local time. The get_expiration_seconds_v4() method replaces that "None" timezone with a UTC tzinfo, which results in an inaccurate timestamp that was generated for local time but is now presented as UTC.

There is no way to safely handle tzinfo=None user input in Python. The library should either document that tzinfo=None will be treated as either local time or UTC (current behavior, UTC) or else it should reject timestamps without tzinfo for safety.

The system test TestV4POSTPolicies.test_get_signed_policy_v4() will also fail when run in a timezone west of the equator and should be modified along with the above code. Warning: it is possible Kokoro is not running in a timezone west of the equator and will not manifest this error.

Metadata

Metadata

Labels

api: storageIssues related to the googleapis/python-storage API.priority: p2Moderately-important priority. Fix may not be included in next release.type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions