From a0b5007d4026393da70156eab46d71f98bebfed8 Mon Sep 17 00:00:00 2001 From: dualfroz Date: Fri, 4 Sep 2026 09:31:35 +0200 Subject: [PATCH] fix: reject stray pipe in sign by using [+-] character class Inside a character class '|' is a literal, so [+|-] matched '+', '-', or '|'. A leading pipe was captured as a sign and stripped, letting malformed input like '|5m' parse to 300 instead of returning None. Restrict the class to the two intended sign characters. --- pytimeparse/tests/testtimeparse.py | 4 ++++ pytimeparse/timeparse.py | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/pytimeparse/tests/testtimeparse.py b/pytimeparse/tests/testtimeparse.py index c305bb5..29f4cef 100644 --- a/pytimeparse/tests/testtimeparse.py +++ b/pytimeparse/tests/testtimeparse.py @@ -83,6 +83,10 @@ class TestTimeparse(unittest.TestCase): self.assertEqual(timeparse.timeparse('- 32 m 1 s'), -1921) self.assertIsNone(timeparse.timeparse('32 m - 1 s')) self.assertIsNone(timeparse.timeparse('32 m + 1 s')) + # A stray pipe is not a valid sign and must not be silently accepted. + self.assertIsNone(timeparse.timeparse('|5m')) + self.assertIsNone(timeparse.timeparse('| 5m')) + self.assertIsNone(timeparse.timeparse('|1:24')) def test_timeparse_1(self): '''timeparse test case 1.''' diff --git a/pytimeparse/timeparse.py b/pytimeparse/timeparse.py index ace5cc3..346596f 100644 --- a/pytimeparse/timeparse.py +++ b/pytimeparse/timeparse.py @@ -33,7 +33,7 @@ kinds of time expressions. import re -SIGN = r'(?P[+|-])?' +SIGN = r'(?P[+-])?' #YEARS = r'(?P\d+)\s*(?:ys?|yrs?.?|years?)' #MONTHS = r'(?P\d+)\s*(?:mos?.?|mths?.?|months?)' WEEKS = r'(?P[\d.]+)\s*(?:w|wks?|weeks?)'