Only ASCII digits should be accepted

[lumikanta]

With Python 3 regex allows use of some unicode digits - rfc3339_regex = re.compile( r"^(\d\d\d\d)-(\d\d)-(\d\d)T" r"(\d\d):(\d\d):(\d\d)(.\d+)?(Z|([+-])(\d\d):(\d\d))$")

Forcing to ASCII only would make results safer: rfc3339_regex = re.compile( r"^([0-9]{4})-([0-9]{2})-([0-9]{2})T" r"([0-9]{2}):([0-9]{2}):([0-9]{2})(.[0-9]+)?(Z|([+-])([0-9]{2}):([0-9]{2}))$")

For example with Python 3 all these are treated as valid: ['2018-12-24T11:32:00Z', '٢٠١٨-٠١-٠١T١٢:٠٣:١٦.٨٧٩+08:00', '௨௦௫௮-௧௧-௦௯T04:04:04Z', '๒๐๑๘-๐๒-๑๒T๒๒:๒๒:๒๒.๒๒๒Z', '201๒-0๒-0๒T๒๒:๒๒:๒๒.๒๒๒Z']

With Python 2.7 only first one is accepted.

[danielrichman]

ooh, good point, thanks. I'll try and dust off the python dev environment and fix this (and the other things in the backlog) soon.