Skip to content

[TINKERPOP-3276][gremlin-javascript] Reject out-of-range OffsetDateTime values#3549

Open
xiazcy wants to merge 2 commits into
3.8-devfrom
TINKERPOP-3276
Open

[TINKERPOP-3276][gremlin-javascript] Reject out-of-range OffsetDateTime values#3549
xiazcy wants to merge 2 commits into
3.8-devfrom
TINKERPOP-3276

Conversation

@xiazcy

@xiazcy xiazcy commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Summary

The gremlin-javascript OffsetDateTime deserializers constructed a native Date without validating the result. JavaScript's Date has a much narrower range than Gremlin/JVM date-time types, so extreme boundary values (e.g. years near ±999999999, or OffsetDateTime.MAX/MIN) produced NaN. Because new Date(NaN) does not throw, deserialization appeared to succeed but returned an unusable Date:

value instanceof Date          // true
Number.isNaN(value.getTime())  // true
value.toISOString()            // throws RangeError

Both readers now detect that condition and fail deserialization with a clear error, so unsupported boundary values are rejected up front rather than silently becoming invalid Date instances — consistent with how other unsupported values are handled.

Changes

  • GraphBinary (internals/OffsetDateTimeSerializer.js): after building the Date from the wire fields, throw if Number.isNaN(v.getTime()).
  • GraphSON (type-serializers.js): the same guard in OffsetDateTimeSerializer.deserialize, for parity.
  • Added OffsetDateTimeSerializer-test.js (GraphBinary) covering normal round-trips and boundary rejection for ±999999999.
  • Added GraphSON reader tests: a normal gx:OffsetDateTime round-trip and boundary rejection for expanded-year ISO strings.

VOTE +1

Validate the constructed Date in the GraphBinary and GraphSON
OffsetDateTime readers and throw when it falls outside the range
representable by a JavaScript Date, instead of silently returning an
invalid Date.

https://issues.apache.org/jira/browse/TINKERPOP-3276

Assisted-by: Kiro:Claude-Opus-4.8
@Cole-Greer

Copy link
Copy Markdown
Contributor

VOTE +1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants