[GH-ISSUE #6524] [Bug] Environment clock parsing accepts out-of-range timezone offsets #3917

New issue

Closed

opened 2026-10-31 00:45:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:13 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6524

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The environment clock reader accepts malformed timezone offsets as valid ISO clock values. A direct execution of the production readClock helper accepted +00:60, +24:00, and +99:99, returning an epoch value and retaining each invalid offset as its clock format. Each input was probed once, with a valid +00:00 control.

The helper behavior was executed. Effects in environment extraction, serving, and environment-compare are source-derived; those public workflows were not run.

Reproduction

Executed source-level probe, with the import path shown relative to the checkout for portability:

node --input-type=module <<'JS'
import { readClock } from './src/domain/analysisView/environmentStateWriteValues.ts';
for (const value of [
  '2000-01-01T12:00:00+00:00',
  '2000-01-01T12:00:00+00:60',
  '2000-01-01T12:00:00+24:00',
  '2000-01-01T12:00:00+99:99',
]) {
  const result = readClock(value);
  console.log(JSON.stringify({input:value,result:result??null}));
}
JS

The probe used Node's TypeScript source support and required no REA build or dependencies. This is helper-level execution, not a CLI/MCP reproduction. No post-draft reverification was performed.

Expected behavior

Reject out-of-range offset hours or minutes as clock interpretations while retaining the original source string as ordinary data. The helper promises undefined for a value that is not an ISO date-time. RFC 3339 section 5.6 defines numeric offsets using hours in 00–23 and minutes in 00–59. The demonstrated values violate those ranges.

Impact and scope

Observed: invalid offsets receive a fabricated instant and a clock format. Source-derived reach: the shared reader feeds environment clock-rule inference, clock respelling, and comparison normalization. environment-compare can count an invalid timestamp as a normalized clock rather than preserving the distinction between a valid clock and malformed text. No full environment run, user incident, or real artifact frequency was measured.

NOT_ENOUGH_INFO: no practical user-level workaround was tested. Correcting the input capture would change its recorded evidence.

REA version

Main source revision 49c9c9d4a14cc7d5509ec28a304dab48f85cb045 (package metadata says 6.7.0). This source file is absent from latest published tag rea-agents-6.7.0, commit 27dc42d10249f0410904a75c0997842eb03b931c; no published-package impact is claimed.

Runtime and platform

Node.js v26.12.1; Linux x64. Direct production-helper execution only; no browser or external provider.

Target and artifact context

Synthetic timestamp strings passed to the environment state's clock interpretation helper. No private target data.

Interface

Other

Shared environment clock helper; CLI and MCP were not executed.

Earliest failure stage

Transport or result projection

Relevant output or evidence

Selected observed output from the probe:

+00:00 -> ms=946728000000, format.zone="+00:00"
+00:60 -> ms=946724400000, format.zone="+00:60"
+24:00 -> ms=946641600000, format.zone="+24:00"
+99:99 -> ms=946365660000, format.zone="+99:99"

Offset matching and conversion accept any two decimal digits for each component, then turn them into minutes without a range check. The round-trip validation checks the local calendar fields before applying the unchecked zone.

Source-derived consumer behavior: comparison derives a clock format from readClock, then normalizes two equal formats as clocks. End-to-end consumer output is NOT_ENOUGH_INFO.

Triage assessment

Impact level: P2
Assessment status: provisional
Impact basis: Production-helper execution establishes invalid clock admission; the shared source feeds replay/inference and normalization, but the consequential public workflow was not executed.
Workaround status: unverified
Workaround basis: No user-level procedure that preserves the original recorded strings and restores correct clock interpretation was tested.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6524 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior The environment clock reader accepts malformed timezone offsets as valid ISO clock values. A direct execution of the production `readClock` helper accepted `+00:60`, `+24:00`, and `+99:99`, returning an epoch value and retaining each invalid offset as its clock format. Each input was probed once, with a valid `+00:00` control. The helper behavior was executed. Effects in environment extraction, serving, and `environment-compare` are source-derived; those public workflows were not run. ### Reproduction Executed source-level probe, with the import path shown relative to the checkout for portability: ```sh node --input-type=module <<'JS' import { readClock } from './src/domain/analysisView/environmentStateWriteValues.ts'; for (const value of [ '2000-01-01T12:00:00+00:00', '2000-01-01T12:00:00+00:60', '2000-01-01T12:00:00+24:00', '2000-01-01T12:00:00+99:99', ]) { const result = readClock(value); console.log(JSON.stringify({input:value,result:result??null})); } JS ``` The probe used Node's TypeScript source support and required no REA build or dependencies. This is helper-level execution, not a CLI/MCP reproduction. No post-draft reverification was performed. ### Expected behavior Reject out-of-range offset hours or minutes as clock interpretations while retaining the original source string as ordinary data. The helper promises undefined for a value that is not an ISO date-time. [RFC 3339 section 5.6](https://www.rfc-editor.org/rfc/rfc3339#section-5.6) defines numeric offsets using hours in 00–23 and minutes in 00–59. The demonstrated values violate those ranges. ### Impact and scope Observed: invalid offsets receive a fabricated instant and a clock format. Source-derived reach: the shared reader feeds environment clock-rule inference, clock respelling, and comparison normalization. `environment-compare` can count an invalid timestamp as a normalized clock rather than preserving the distinction between a valid clock and malformed text. No full environment run, user incident, or real artifact frequency was measured. `NOT_ENOUGH_INFO`: no practical user-level workaround was tested. Correcting the input capture would change its recorded evidence. ### REA version Main source revision `49c9c9d4a14cc7d5509ec28a304dab48f85cb045` (package metadata says 6.7.0). This source file is absent from latest published tag `rea-agents-6.7.0`, commit `27dc42d10249f0410904a75c0997842eb03b931c`; no published-package impact is claimed. ### Runtime and platform Node.js v26.12.1; Linux x64. Direct production-helper execution only; no browser or external provider. ### Target and artifact context Synthetic timestamp strings passed to the environment state's clock interpretation helper. No private target data. ### Interface Other Shared environment clock helper; CLI and MCP were not executed. ### Earliest failure stage Transport or result projection ### Relevant output or evidence Selected observed output from the probe: ```text +00:00 -> ms=946728000000, format.zone="+00:00" +00:60 -> ms=946724400000, format.zone="+00:60" +24:00 -> ms=946641600000, format.zone="+24:00" +99:99 -> ms=946365660000, format.zone="+99:99" ``` [Offset matching and conversion](https://github.com/morluto/rea/blob/49c9c9d4a14cc7d5509ec28a304dab48f85cb045/src/domain/analysisView/environmentStateWriteValues.ts#L21-L31) accept any two decimal digits for each component, then turn them into minutes without a range check. [The round-trip validation](https://github.com/morluto/rea/blob/49c9c9d4a14cc7d5509ec28a304dab48f85cb045/src/domain/analysisView/environmentStateWriteValues.ts#L34-L71) checks the local calendar fields before applying the unchecked zone. Source-derived consumer behavior: [comparison derives a clock format from readClock](https://github.com/morluto/rea/blob/49c9c9d4a14cc7d5509ec28a304dab48f85cb045/src/application/environment/environmentCompareDiff.ts#L66-L79), then [normalizes two equal formats as clocks](https://github.com/morluto/rea/blob/49c9c9d4a14cc7d5509ec28a304dab48f85cb045/src/application/environment/environmentCompareDiff.ts#L179-L190). End-to-end consumer output is `NOT_ENOUGH_INFO`. ## Triage assessment - Impact level: P2 - Assessment status: provisional - Impact basis: Production-helper execution establishes invalid clock admission; the shared source feeds replay/inference and normalization, but the consequential public workflow was not executed. - Workaround status: unverified - Workaround basis: No user-level procedure that preserves the original recorded strings and restores correct clock interpretation was tested.

bsakaguchi closed this issue

2026-10-31 00:45:13 +00:00

bsakaguchi referenced this issue

2026-11-01 21:46:11 +00:00

[PR #6233] [MERGED] feat(native): let callers raise the Apple dispatch metadata input budget #7214