Skip to content

fix: avoid panic in ParseDuration on trailing whitespace - #279

Closed
bernot-dev wants to merge 1 commit into
go-openapi:masterfrom
bernot-dev:duration-whitespace-panic
Closed

fix: avoid panic in ParseDuration on trailing whitespace#279
bernot-dev wants to merge 1 commit into
go-openapi:masterfrom
bernot-dev:duration-whitespace-panic

Conversation

@bernot-dev

@bernot-dev bernot-dev commented Jul 10, 2026

Copy link
Copy Markdown

Change type

🔧 Bug fix

Short description

Trim leading and trailing whitespace from the input duration string at the start of ParseDuration. This prevents a panic in the parsing loop when strings.TrimLeftFunc(s, unicode.IsSpace) trims a string consisting entirely of trailing spaces into an empty string, which subsequently causes an index out of bounds error when checking s[0]. Added regression test cases covering leading, trailing, and combined spaces around durations (e.g., " 1s ", "1s ", " 1s").

Fixes

N/A

Full description

Checklist

  • I have signed all my commits with my name and email (see DCO. This does not require a PGP-signed commit
  • I have rebased and squashed my work, so only one commit remains
  • I have added tests to cover my changes.
  • I have properly enriched go doc comments in code.
  • I have properly documented any breaking change.

Trim leading and trailing whitespace from the input duration string
at the start of ParseDuration. This prevents a panic in the parsing loop
when strings.TrimLeftFunc(s, unicode.IsSpace) trims a string consisting
entirely of trailing spaces into an empty string, which subsequently
causes an index out of bounds error when checking s[0].
Added regression test cases covering leading, trailing, and combined
spaces around durations (e.g., "  1s ", "1s   ", "   1s").

Signed-off-by: Adam Bernot <bernot@google.com>
@fredbi

fredbi commented Jul 12, 2026

Copy link
Copy Markdown
Member

Thank you for reporting this bug.
However, I think that trimming the string ahead, wholesale, is not the best way to address this issue.

I had in mind to add fuzz tests on all these parsers anyway, so here is an alternate fix to this issue, less intrusive and with fuzz tests so we may safely any similar issue in this parser: #281

Forthcoming PR is to fuzz all parsers, which was a long overdue task.

@fredbi

fredbi commented Jul 12, 2026

Copy link
Copy Markdown
Member

Superseded by #281. Good catch on the issue, but I won't merge this proposed fix.

@fredbi fredbi closed this Jul 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants