Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
This change alters core reference-date semantics shared by every locale and parser, so it warrants human sign-off despite no objective defects being found.
0 open findings
What changed in this PR
This PR fixes a cross-realm Date detection bug (issue #603) where a Date created in another JavaScript realm (e.g., a BigQuery UDF or an iframe) fails the local instanceof Date check in ReferenceWithTimezone.fromInput. As a result, such a reference date was misinterpreted as a ParsingReference object with no instant, silently falling back to the current time. The fix replaces the instanceof check with an intrinsic-based isDate helper, so genuine Dates from any realm are recognized while reference objects and date-like decoys are not.
Changes:
- Added an
isDatehelper insrc/results.tsthat usesDate.prototype.getTime.call(input)(intrinsic slot check) to detect Dates across realms, including invalid Dates. - Switched
ReferenceWithTimezone.fromInputto useisDateinstead ofinput instanceof Date. - Added
test/reference.test.tswith regression and control coverage for foreign/local, valid/invalid, spoofed-tag, wrapped, and omitted reference inputs.
| File | Description |
|---|---|
src/results.ts |
Introduces the realm-agnostic isDate helper and uses it in fromInput to correctly classify cross-realm Date references. |
test/reference.test.ts |
New tests covering cross-realm dates, invalid dates, timezone-bearing reference objects, spoofed Date tags/wrappers, and default-to-now fallbacks. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Closes #603.
A
Datecreated in another realm fails the localinstanceof Datecheck and is treated as aParsingReferenceobject, so a direct date reference silently falls back to the current time. Recognize dates using the intrinsicDate.prototype.getTimecheck instead. Invalid dates remain date references, while reference objects retain theirinstantand timezone;Symbol.toStringTag,getTime, and coercion methods alone do not turn an object into a date.Reproduced through both built package entry points on Node 22.22.3 with
TZ=UTC:Seven regression/control tests cover public
parse/parseDateresults and match boundaries, invalid local and foreign dates, a genuine date with an overridden tag/method, timezone-bearing reference objects, spoofed date tags, wrapped values, and omitted references. The direct foreign-date and invalid foreign-date cases failed before the fix; the existing-behavior controls passed.Validation:
--detectOpenHandlespassed all 760 tests without a handle warning.tsc --noEmit, CJS/ESM builds, requirednpm run prettier, full Prettier check, andgit diff --checkpassed.npm run eslinthas the same pre-existing failure on master and this change: ESLint 9 expects a flat config, while the repository provides legacy configuration in package.json. No configuration/dependency changes are included.The cross-realm reproduction uses Node
vm; BigQuery and browser iframe execution were not tested directly. Public types and accepted text formats are unchanged.