Skip to content

Installation and Bot reject ISO 8601 timestamps with a negative UTC offset or a Z suffix #1989

Open

Description

@sebxt

What happens

Installation, Bot and the token rotation code accept installed_at (and *_token_expires_at) as an ISO 8601 string. Strings with a positive offset parse correctly, but a negative offset or a Z suffix raises ValueError:

from slack_sdk.oauth.installation_store import Installation

Installation(
    user_id="U111",
    installed_at="2021-07-14T03:00:17-05:00",
)
# ValueError: Invalid isoformat string: '2021-07-14T03:00:17-05:00+00:00'

Installation(
    user_id="U111",
    installed_at="2021-07-14T08:00:17Z",
)
# ValueError: Invalid isoformat string: '2021-07-14T08:00:17Z+00:00'  (Python 3.11+)

"2021-07-14T17:00:17+09:00" works, so the result depends on the sign of the offset.

What should happen

Any string datetime.fromisoformat can parse should be accepted. Strings without an offset should keep being treated as UTC.

Root cause

_from_iso_format_to_datetime in slack_sdk/oauth/installation_store/internals.py decides whether a string already has an offset by checking for a + character:

if "+" not in iso_datetime_str:
    iso_datetime_str += "+00:00"
return datetime.fromisoformat(iso_datetime_str)

For -05:00 or Z there is no +, so a second offset is appended and parsing fails. Parsing first and setting UTC only when tzinfo is None fixes it, which matches how naive datetime values are already handled in _timestamp_to_type since #1970.

Activity

  1. added
    bugM-T: A confirmed bug report. Issues are confirmed when the reproduction steps are documented
    on Oct 20, 2026
  2. hello-ashleyintech commented on Oct 20, 2026

    @hello-ashleyintech
    Contributor

    Hi, @auraseb! Thanks so much for submitting this bug and opening a fix for it, I was able to confirm it on my end. I saw my teammate is taking a look at it, please make sure you sign the Salesforce Inc. Contributor License Agreement so we can proceed with your contribution once it's in a good state to merge!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

bugM-T: A confirmed bug report. Issues are confirmed when the reproduction steps are documented

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions