From a1c07f9e313effdc19938386fb175f6ebb3cbf7c Mon Sep 17 00:00:00 2001
From: Rasmus Thomsen <oss@cogitri.dev>
Date: Fri, 24 Dec 2021 12:40:26 +0100
Subject: [PATCH] Port from chrono to time 0.3

Chrono has been unmaintained for some time now and has had open CVEs
for a while now that aren't getting fixed. See https://github.com/chronotope/chrono/issues/602
---
 Cargo.toml          |  3 +--
 src/lib.rs          |  9 ++++-----
 src/matching/mod.rs | 16 +++++++++-------
 src/scoring.rs      |  6 ++++--
 4 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index c25b78d..308c14f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,7 +20,7 @@ itertools = "0.10.0"
 lazy_static = "1.3"
 quick-error = "2.0"
 regex = "1"
-chrono = { version = "0.4.7", default-features = false, features = ["clock", "std"] }
+time = { version = "0.3", features = ["local-offset"] }
 
 [dependencies.serde]
 optional = true
@@ -42,7 +42,6 @@ wasm-bindgen-test = "0.3"
 default = ["builder"]
 ser = ["serde", "serde_derive"]
 builder = ["derive_builder"]
-wasmbind = ["chrono/wasmbind"]
 
 [profile.test]
 opt-level = 2
diff --git a/src/lib.rs b/src/lib.rs
index 3a452c8..245de46 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -17,8 +17,8 @@ extern crate serde;
 #[cfg(feature = "ser")]
 #[macro_use]
 extern crate serde_derive;
-use chrono::Utc;
-use std::time::Duration;
+use std::{convert::TryFrom, time::Duration};
+use time::OffsetDateTime;
 
 #[cfg(test)]
 #[macro_use]
@@ -116,7 +116,7 @@ pub fn zxcvbn(password: &str, user_inputs: &[&str]) -> Result<Entropy, ZxcvbnErr
         return Err(ZxcvbnError::BlankPassword);
     }
 
-    let start_time = Utc::now();
+    let start_time = OffsetDateTime::now_utc();
 
     // Only evaluate the first 100 characters of the input.
     // This prevents potential DoS attacks from sending extremely long input strings.
@@ -130,8 +130,7 @@ pub fn zxcvbn(password: &str, user_inputs: &[&str]) -> Result<Entropy, ZxcvbnErr
 
     let matches = matching::omnimatch(&password, &sanitized_inputs);
     let result = scoring::most_guessable_match_sequence(&password, &matches, false);
-    let calc_time = (Utc::now() - start_time)
-        .to_std()
+    let calc_time = Duration::try_from(OffsetDateTime::now_utc() - start_time)
         .map_err(|_| ZxcvbnError::DurationOutOfRange)?;
     let (crack_times, score) = time_estimates::estimate_attack_times(result.guesses);
     let feedback = feedback::get_feedback(score, &matches);
diff --git a/src/matching/mod.rs b/src/matching/mod.rs
index c82623b..75fd436 100644
--- a/src/matching/mod.rs
+++ b/src/matching/mod.rs
@@ -414,11 +414,11 @@ impl Matcher for RepeatMatch {
         let char_count = password.chars().count();
         while last_index < char_count {
             let token = char_indexable_password.char_index(last_index..char_count);
-            let greedy_matches = GREEDY_REGEX.captures(token).unwrap();
+            let greedy_matches = GREEDY_REGEX.captures(&token).unwrap();
             if greedy_matches.is_none() {
                 break;
             }
-            let lazy_matches = LAZY_REGEX.captures(token).unwrap();
+            let lazy_matches = LAZY_REGEX.captures(&token).unwrap();
             let greedy_matches = greedy_matches.unwrap();
             let lazy_matches = lazy_matches.unwrap();
             let m4tch;
@@ -637,7 +637,7 @@ impl Matcher for DateMatch {
                     break;
                 }
                 let token_str = char_indexable.char_index(i..j + 1);
-                if !MAYBE_DATE_NO_SEPARATOR_REGEX.is_match(token_str) {
+                if !MAYBE_DATE_NO_SEPARATOR_REGEX.is_match(&token_str) {
                     continue;
                 }
                 let token = CharIndexableStr::from(token_str);
@@ -802,7 +802,7 @@ fn map_ints_to_ymd(first: u16, second: u16, third: u16) -> Option<(i32, i8, i8)>
 /// Takes two ints and returns them in a (m, d) tuple
 fn map_ints_to_md(first: u16, second: u16) -> Option<(i8, i8)> {
     for &(d, m) in &[(first, second), (second, first)] {
-        if (1..=31).contains(&d) && (1..=12).contains(&m) {
+        if 1 <= d && d <= 31 && 1 <= m && m <= 12 {
             return Some((m as i8, d as i8));
         }
     }
@@ -1442,8 +1442,10 @@ mod tests {
 
     #[test]
     fn test_date_matches_year_closest_to_reference_year() {
-        use chrono::{Datelike, Local};
-        let password = format!("1115{}", Local::today().year() % 100);
+        use time::OffsetDateTime;
+
+        let now = OffsetDateTime::now_local().unwrap_or_else(|_| OffsetDateTime::now_utc());
+        let password = format!("1115{}", now.year() % 100);
         let matches = (matching::DateMatch {}).get_matches(&password, &HashMap::new());
         let m = matches.iter().find(|m| m.token == password).unwrap();
         assert_eq!(m.i, 0);
@@ -1453,7 +1455,7 @@ mod tests {
         } else {
             panic!("Wrong match pattern")
         };
-        assert_eq!(p.year, Local::today().year());
+        assert_eq!(p.year, now.year());
         assert_eq!(p.month, 11);
         assert_eq!(p.day, 15);
         assert_eq!(p.separator, "".to_string());
diff --git a/src/scoring.rs b/src/scoring.rs
index 65aef8c..d6b4bff 100644
--- a/src/scoring.rs
+++ b/src/scoring.rs
@@ -1,8 +1,8 @@
 use crate::matching::patterns::*;
 use crate::matching::Match;
-use chrono::{Datelike, Local};
 use std::cmp;
 use std::collections::HashMap;
+use time::OffsetDateTime;
 
 #[derive(Debug, Clone)]
 pub struct GuessCalculation {
@@ -29,7 +29,9 @@ struct Optimal {
 }
 
 lazy_static! {
-    pub(crate) static ref REFERENCE_YEAR: i32 = Local::today().year();
+    pub(crate) static ref REFERENCE_YEAR: i32 = OffsetDateTime::now_local()
+        .unwrap_or_else(|_| OffsetDateTime::now_utc())
+        .year();
 }
 const MIN_YEAR_SPACE: i32 = 20;
 const BRUTEFORCE_CARDINALITY: u64 = 10;