From: Robert Klemme <shortcutter@...>
Date: 2009-09-01T23:51:17+09:00
Subject: Re: Date & time validation

2009/9/1 Brian Candler <b.candler@pobox.com>:
> Max Williams wrote:
>> date = (string =~ /^\d{4}\/\d{2}\/\d{2}$/) &&
>
> Beware: use
>
> date = (string =~ /\A\d{4}\/\d{2}\/\d{2}\z/) ...
>
> or else malicious inputs may be able to bypass your validation. (They
> might not be able to bypass Date.strptime in this particular instance,
> but still you ought to validate correctly)

Then you can do:

16:48:53 ~$ irb19 -r date
Ruby version 1.9.1
irb(main):001:0> %w{2009/10/11 2009/10/44}.each do |s|
irb(main):002:1* p s
irb(main):003:1> date = %r{\A(\d{4})/(\d{2})/(\d{2})\z} =~ s &&
Date.new($1.to_i, $2.to_i, $3.to_i)
irb(main):004:1> end
"2009/10/11"
"2009/10/44"
ArgumentError: invalid date
        from /opt/lib/ruby19/1.9.1/date.rb:809:in `civil'
        from (irb):6:in `block in irb_binding'
        from (irb):4:in `each'
        from (irb):4
        from /opt/bin/irb19:12:in `<main>'
irb(main):005:0>

Cheers

robert

-- 
remember.guy do |as, often| as.you_can - without end
http://blog.rubybestpractices.com/