Skip to content

Reject booleans in from_timestamp_ms, consistent with from_timestamp#2904

Merged
sloria merged 5 commits intomarshmallow-code:devfrom
bysiber:fix/from-timestamp-ms-reject-bool
Mar 25, 2026
Merged

Reject booleans in from_timestamp_ms, consistent with from_timestamp#2904
sloria merged 5 commits intomarshmallow-code:devfrom
bysiber:fix/from-timestamp-ms-reject-bool

Conversation

@bysiber
Copy link
Copy Markdown
Contributor

@bysiber bysiber commented Feb 20, 2026

Summary

from_timestamp_ms doesn't reject boolean values, unlike from_timestamp. This allows DateTime(format="timestamp_ms") to silently accept True/False as valid timestamps.

Problem

from_timestamp has an explicit boolean guard:

def from_timestamp(value):
    if value is True or value is False:
        raise ValueError("Not a valid POSIX timestamp")
    value = float(value)
    ...

But from_timestamp_ms converts to float first:

def from_timestamp_ms(value):
    value = float(value)          # float(True) = 1.0, float(False) = 0.0
    return from_timestamp(value / 1000)  # boolean check sees 0.001, not True

Since float(True) produces 1.0, by the time from_timestamp is called, the value is already a float and the value is True identity check fails. This means:

  • DateTime(format="timestamp") correctly rejects True/False
  • DateTime(format="timestamp_ms") silently accepts them, deserializing True as a datetime

Fix

Add the same boolean rejection to from_timestamp_ms before the float() conversion.

from_timestamp explicitly rejects True/False before converting to float,
but from_timestamp_ms calls float(value) first, converting booleans to
1.0/0.0 before from_timestamp ever sees them. This means the boolean
check in from_timestamp is bypassed.

Add the same boolean guard to from_timestamp_ms so that
DateTime(format="timestamp_ms") rejects booleans just like
DateTime(format="timestamp") does.
@bysiber bysiber force-pushed the fix/from-timestamp-ms-reject-bool branch from 24a55ef to 2288b62 Compare February 20, 2026 06:56
@sloria sloria enabled auto-merge (squash) March 25, 2026 22:33
@sloria sloria merged commit 72ac4a0 into marshmallow-code:dev Mar 25, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants