{"record":{"id":"c76c4b1fca2050b5","repo":"ory/hydra","slug":"value-is-out-of-range","errorCode":null,"errorMessage":"value is out of range","messagePattern":"value is out of range","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/mapx/type_assert.go","lineNumber":71,"sourceCode":"// GetTime returns a string slice for a given key in values.\nfunc GetTime[K comparable](values map[K]any, key K) (time.Time, error) {\n\tv, ok := values[key]\n\tif !ok {\n\t\treturn time.Time{}, ErrKeyDoesNotExist\n\t}\n\n\tswitch v := v.(type) {\n\tcase time.Time:\n\t\treturn v, nil\n\tcase int64:\n\t\treturn time.Unix(v, 0), nil\n\tcase int32:\n\t\treturn time.Unix(int64(v), 0), nil\n\tcase int:\n\t\treturn time.Unix(int64(v), 0), nil\n\tcase float64:\n\t\tif v < math.MinInt64 || v > math.MaxInt64 {\n\t\t\treturn time.Time{}, errors.New(\"value is out of range\")\n\t\t}\n\t\treturn time.Unix(int64(v), 0), nil\n\tcase float32:\n\t\tif v < math.MinInt64 || v > math.MaxInt64 {\n\t\t\treturn time.Time{}, errors.New(\"value is out of range\")\n\t\t}\n\t\treturn time.Unix(int64(v), 0), nil\n\t}\n\n\treturn time.Time{}, ErrKeyCanNotBeTypeAsserted\n}\n\n// GetInt64 returns an int64 for a given key in values.\nfunc GetInt64[K comparable](values map[K]any, key K) (int64, error) {\n\tv, ok := values[key]\n\tif !ok {\n\t\treturn 0, ErrKeyDoesNotExist\n\t}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/mapx/type_assert.go#L53-L89","documentation":"GetTime in oryx/mapx/type_assert.go returns this ad-hoc error when a float64 value (e.g. a JSON-decoded Unix timestamp) exceeds the representable range of int64, so converting it via time.Unix would overflow. The check is v < math.MinInt64 || v > math.MaxInt64. It protects callers from silently creating an invalid/wrapped time value.","triggerScenarios":"Calling mapx.GetTime on a map value of type float64 whose magnitude is larger than math.MaxInt64 or smaller than math.MinInt64 (line 71 of type_assert.go).","commonSituations":"Corrupt or maliciously crafted JWT 'exp'/'iat'/'nbf' claims holding astronomically large float values; decoding binary or scientific-notation numbers as float64; unit tests with sentinel values like 1e300.","solutions":["Validate the numeric magnitude before calling GetTime (clamp or reject values outside int64 range).","Guard the call and treat the out-of-range error as invalid token/data input (reject the claim).","Fix the data source so timestamps are sane Unix seconds/milliseconds.","If milliseconds are expected, divide by 1000 before conversion so values fit in int64."],"exampleFix":"// before\nv, _ := claims[\"exp\"].(float64)\nt, err := mapx.GetTime(claims, \"exp\")\n// after\nif v, ok := claims[\"exp\"].(float64); ok && v >= math.MinInt64 && v <= math.MaxInt64 {\n    t, err := mapx.GetTime(claims, \"exp\")\n    _ = t\n}","handlingStrategy":"validation","validationCode":"if v, ok := claims[\"exp\"].(float64); !ok || v < math.MinInt64 || v > math.MaxInt64 {\n    // reject or clamp before calling mapx.GetTime\n}","typeGuard":"func safeTimestamp(v any) (float64, bool) {\n    f, ok := v.(float64)\n    if !ok || f < math.MinInt64 || f > math.MaxInt64 {\n        return 0, false\n    }\n    return f, true\n}","tryCatchPattern":"t, err := mapx.GetTime(claims, \"exp\")\nif err != nil && err.Error() == \"value is out of range\" {\n    // treat as invalid timestamp: reject token/claim\n}","preventionTips":["Validate numeric claim magnitudes before converting to time.Time.","Treat out-of-range timestamps as malformed tokens and fail closed.","Watch for millisecond-vs-second confusion that inflates values.","Add unit tests with extreme float values (1e300, -1e300) around time extraction."],"tags":["go","range-overflow","time","mapx"],"backgroundTag":"value-out-of-range","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}