Fix: UTCTime Issues (#47)

Author: sephynox

src/utils.rs

@@ -52,25 +52,34 @@ pub(crate) fn get_words_from_big_int(data: BigInt) -> (bool, Vec<u64>) {
 #[allow(deprecated)]
 pub(crate) fn get_utc_date_time_from_asn1_milli<T: AsRef<[u8]>>(data: T) -> Result<DateTime<Utc>> {
 	let mut decoder = rasn::ber::de::Decoder::new(data.as_ref(), DecoderOptions::ber());
-	let (decoded, format) = match data.as_ref().first().unwrap_or(&0) {
+	let (decoded, format, is_utc_time) = match data.as_ref().first().unwrap_or(&0) {
 		0x17 => (
 			Utf8String::decode_with_tag(&mut decoder, Tag::UTC_TIME),
 			ASN1_DATE_TIME_UTC_FORMAT,
+			true,
 		),
 		0x18 => (
 			Utf8String::decode_with_tag(&mut decoder, Tag::GENERALIZED_TIME),
 			ASN1_DATE_TIME_GENERAL_FORMAT_WITH_MS,
+			false,
 		),
 		_ => bail!(ASN1NAPIError::MalformedData),
 	};
 
 	if let Ok(decoded) = decoded {
 		if let Some(offset) = FixedOffset::east_opt(0) {
-			Ok(DateTime::<FixedOffset>::from_utc(
-				NaiveDateTime::parse_from_str(&decoded, format)?,
-				offset,
-			)
-			.with_timezone(&Utc))
+			let mut naive = NaiveDateTime::parse_from_str(&decoded, format)?;
+
+			// RFC 5280 §4.1.2.5.1: UTCTime pivots at 50 (>= 50 → 19xx),
+			// but chrono's %y pivots at 70. Correct the 50-69 range.
+			// See `<https://github.com/chronotope/chrono/issues/1152>`
+			if is_utc_time && naive.year() >= 2050 {
+				naive = naive
+					.with_year(naive.year() - 100)
+					.ok_or(ASN1NAPIError::MalformedData)?;
+			}
+
+			Ok(DateTime::<FixedOffset>::from_utc(naive, offset).with_timezone(&Utc))
 		} else {
 			bail!(ASN1NAPIError::MalformedData)
 		}
@@ -311,7 +320,8 @@ pub(crate) fn header_length(data: &[u8]) -> Result<usize, &'static str> {
 
 #[cfg(test)]
 mod test {
-	use chrono::{TimeZone, Utc};
+	use anyhow::Result;
+	use chrono::{Datelike, TimeZone, Utc};
 	use num_bigint::BigInt;
 
 	use crate::utils::get_utf16_from_string;
@@ -321,56 +331,106 @@ mod test {
 	use super::get_utc_date_time_from_asn1_milli;
 	use super::get_words_from_big_int;
 
+	fn build_time_der(tag: u8, time_str: &str) -> Vec<u8> {
+		let bytes = time_str.as_bytes();
+		let mut der = Vec::with_capacity(2 + bytes.len());
+		der.push(tag);
+		der.push(bytes.len() as u8);
+		der.extend_from_slice(bytes);
+		der
+	}
+
+	fn utc_time_der(time_str: &str) -> Vec<u8> {
+		build_time_der(0x17, time_str)
+	}
+
+	fn generalized_time_der(time_str: &str) -> Vec<u8> {
+		build_time_der(0x18, time_str)
+	}
+
 	#[test]
 	fn test_get_utf16_from_string() {
 		assert_eq!(get_utf16_from_string("test"), vec![0x74, 0x65, 0x73, 0x74]);
 	}
 
 	#[test]
-	fn test_get_oid_elements_from_string() {
-		assert_eq!(
-			get_oid_elements_from_string("2.5.4.5").unwrap(),
-			vec![2, 5, 4, 5]
-		);
-	}
+	fn test_oid_roundtrip() -> Result<()> {
+		let cases: &[(&str, &[u32])] = &[("2.5.4.5", &[2, 5, 4, 5])];
+
+		for (string, elements) in cases {
+			assert_eq!(
+				get_oid_elements_from_string(string)?,
+				*elements,
+				"parse {string}"
+			);
+			assert_eq!(
+				get_string_from_oid_elements(*elements)?,
+				*string,
+				"format {elements:?}"
+			);
+		}
 
-	#[test]
-	fn test_get_string_from_oid_elements() {
-		assert_eq!(
-			get_string_from_oid_elements([2, 5, 4, 5]).unwrap(),
-			"2.5.4.5"
-		);
+		Ok(())
 	}
 
 	#[test]
 	fn test_get_words_from_big_int() {
-		let input = BigInt::from(18591708106338011145_i128);
-		let (negative, words) = get_words_from_big_int(input);
-
-		assert!(!negative);
-		assert_eq!(words, vec![0x203040506070809, 0x01]);
-
-		let input = BigInt::from(-18591708106338011145_i128);
-		let (negative, words) = get_words_from_big_int(input);
+		let cases: &[(i128, bool, &[u64])] = &[
+			(18591708106338011145, false, &[0x203040506070809, 0x01]),
+			(-18591708106338011145, true, &[0x203040506070809, 0x01]),
+		];
 
-		assert!(negative);
-		assert_eq!(words, vec![0x203040506070809, 0x01]);
+		for (value, expected_negative, expected_words) in cases {
+			let (negative, words) = get_words_from_big_int(BigInt::from(*value));
+			assert_eq!(negative, *expected_negative, "sign for {value}");
+			assert_eq!(words.as_slice(), *expected_words, "words for {value}");
+		}
 	}
 
 	#[test]
-	fn test_get_utc_date_time_from_asn1_milli() {
-		let date = Utc.timestamp_millis_opt(1655921880210).unwrap();
-		let input = [
-			24, 19, 50, 48, 50, 50, 48, 54, 50, 50, 49, 56, 49, 56, 48, 48, 46, 50, 49, 48, 90,
+	fn test_utc_time_rfc5280_pivot() -> Result<()> {
+		// RFC 5280 §4.1.2.5.1: >= 50 → 19xx, < 50 → 20xx
+		let cases: &[(&str, i32)] = &[
+			("000601120000Z", 2000), // below pivot, 21st century
+			("490601120000Z", 2049), // boundary: last year below pivot
+			("500601120000Z", 1950), // boundary: first year at pivot
+			("690101000000Z", 1969), // above pivot, chrono disagrees (bug case)
+			("700601120000Z", 1970), // at chrono's pivot, both agree
+			("990601120000Z", 1999), // max 2-digit year
 		];
 
-		assert_eq!(get_utc_date_time_from_asn1_milli(input).unwrap(), date);
+		for (time_str, expected_year) in cases {
+			let result = get_utc_date_time_from_asn1_milli(utc_time_der(time_str))?;
+			assert_eq!(
+				result.year(),
+				*expected_year,
+				"UTCTime {time_str} should decode to year {expected_year}"
+			);
+		}
+
+		Ok(())
+	}
 
-		let date = Utc.with_ymd_and_hms(2022, 9, 26, 10, 0, 0).unwrap();
-		let input = [
-			24, 15, 50, 48, 50, 50, 48, 57, 50, 54, 49, 48, 48, 48, 48, 48, 90,
+	#[test]
+	fn test_generalized_time_decode() -> Result<()> {
+		let cases = [
+			(
+				"20220622181800.210Z",
+				Utc.timestamp_millis_opt(1655921880210).single(),
+			),
+			(
+				"20220926100000Z",
+				Utc.with_ymd_and_hms(2022, 9, 26, 10, 0, 0).single(),
+			),
 		];
 
-		assert_eq!(get_utc_date_time_from_asn1_milli(input).unwrap(), date);
+		for (time_str, expected) in cases {
+			let expected =
+				expected.ok_or_else(|| anyhow::anyhow!("invalid test date {time_str}"))?;
+			let result = get_utc_date_time_from_asn1_milli(generalized_time_der(time_str))?;
+			assert_eq!(result, expected, "GeneralizedTime {time_str}");
+		}
+
+		Ok(())
 	}
 }

tests/date.spec.ts

@@ -3,32 +3,53 @@ import test from 'ava';
 
 import * as lib from '..';
 
-const TEST_DATES: { in: Date; out?: Date; }[] = [
-	{ in: new Date(0) },
-	{ in: new Date('2022-09-26T10:00:00.000+00:00') },
-	{ in: new Date('2022-09-26T10:10:32.420+00:00'), out: new Date('2022-09-26T10:10:32.000+00:00') },
-	{ in: new Date('2052-09-26T10:10:32.420+00:00') },
-]
-
-const TEST_DATES_ASN1 = [
-	new Uint8Array([0x17, 0x0d, 0x37, 0x30, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
-	new Uint8Array([0x17, 0x0d, 0x32, 0x32, 0x30, 0x39, 0x32, 0x36, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
-	new Uint8Array([0x17, 0x0d, 0x32, 0x32, 0x30, 0x39, 0x32, 0x36, 0x31, 0x30, 0x31, 0x30, 0x33, 0x32, 0x5a]).buffer,
-	new Uint8Array([0x18, 0x13, 0x32, 0x30, 0x35, 0x32, 0x30, 0x39, 0x32, 0x36, 0x31, 0x30, 0x31, 0x30, 0x33, 0x32, 0x2e, 0x34, 0x32, 0x30, 0x5a]).buffer
+// Each case pairs a JS Date with its expected DER encoding.
+// `out` overrides the expected decode result when encoding is lossy (e.g. ms truncation).
+// RFC 5280 §4.1.2.5.1: UTCTime (0x17) for years < 2050, GeneralizedTime (0x18) for >= 2050.
+const TEST_CASES: { in: Date; out?: Date; der: ArrayBuffer }[] = [
+	{
+		in: new Date(0),
+		der: new Uint8Array([0x17, 0x0d, 0x37, 0x30, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
+	},
+	{
+		in: new Date('2022-09-26T10:00:00.000+00:00'),
+		der: new Uint8Array([0x17, 0x0d, 0x32, 0x32, 0x30, 0x39, 0x32, 0x36, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
+	},
+	{
+		in: new Date('2022-09-26T10:10:32.420+00:00'),
+		out: new Date('2022-09-26T10:10:32.000+00:00'),
+		der: new Uint8Array([0x17, 0x0d, 0x32, 0x32, 0x30, 0x39, 0x32, 0x36, 0x31, 0x30, 0x31, 0x30, 0x33, 0x32, 0x5a]).buffer,
+	},
+	{
+		in: new Date('2052-09-26T10:10:32.420+00:00'),
+		der: new Uint8Array([0x18, 0x13, 0x32, 0x30, 0x35, 0x32, 0x30, 0x39, 0x32, 0x36, 0x31, 0x30, 0x31, 0x30, 0x33, 0x32, 0x2e, 0x34, 0x32, 0x30, 0x5a]).buffer,
+	},
+	// RFC 5280 pivot: UTCTime 2-digit year >= 50 → 19xx, < 50 → 20xx
+	{
+		in: new Date('1950-06-01T12:00:00Z'),
+		der: new Uint8Array([0x17, 0x0d, 0x35, 0x30, 0x30, 0x36, 0x30, 0x31, 0x31, 0x32, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
+	},
+	{
+		in: new Date('1969-01-01T00:00:00Z'),
+		der: new Uint8Array([0x17, 0x0d, 0x36, 0x39, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
+	},
+	{
+		in: new Date('2049-06-01T12:00:00Z'),
+		der: new Uint8Array([0x17, 0x0d, 0x34, 0x39, 0x30, 0x36, 0x30, 0x31, 0x31, 0x32, 0x30, 0x30, 0x30, 0x30, 0x5a]).buffer,
+	},
 ]
 
 test('JS Date to ASN1 conversion', (t) => {
-	TEST_DATES.forEach((v, i) => {
-		t.deepEqual(lib.JStoASN1(v.in).toBER(), TEST_DATES_ASN1[i])
+	TEST_CASES.forEach((v) => {
+		t.deepEqual(lib.JStoASN1(v.in).toBER(), v.der)
 	})
 })
 
 test('ASN1 to Js Date conversion from byte code', (t) => {
-	TEST_DATES_ASN1.forEach((v, i) => {
-		const obj = new lib.ASN1Decoder(v)
-		const expected = TEST_DATES[i].out ?? TEST_DATES[i].in
-		t.deepEqual(obj.intoDate(), expected)
-		t.deepEqual(lib.ASN1toJS(v), expected)
+	TEST_CASES.forEach((v) => {
+		const expected = v.out ?? v.in
+		t.deepEqual(new lib.ASN1Decoder(v.der).intoDate(), expected)
+		t.deepEqual(lib.ASN1toJS(v.der), expected)
 	})
 })
 
@@ -41,10 +62,9 @@ test('ASN1 to Js Date conversion from base64', (t) => {
 })
 
 test('ASN1 to Js Date conversion round trip', (t) => {
-	TEST_DATES_ASN1.forEach((v, i) => {
-		const js = new lib.ASN1Decoder(v)
-
-		t.deepEqual(js.intoDate(), TEST_DATES[i].out ?? TEST_DATES[i].in)
-		t.deepEqual(lib.JStoASN1(lib.ASN1toJS(v)).toBER(), TEST_DATES_ASN1[i])
+	TEST_CASES.forEach((v) => {
+		const expected = v.out ?? v.in
+		t.deepEqual(new lib.ASN1Decoder(v.der).intoDate(), expected)
+		t.deepEqual(lib.JStoASN1(lib.ASN1toJS(v.der)).toBER(), v.der)
 	})
 })