Time Parse Format

ID

go.time_parse_format

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Go

Tags

reliability, suspicious

Description

Reports a time.Parse or Time.Format call whose layout is a string literal that uses a non-reference year. Go layouts spell out the reference instant Mon Jan 2 15:04:05 MST 2006, so only 2006 (and 06) act as the year placeholder; a real-looking year such as 2021 is not interpreted as the year and the layout silently fails.

Rationale

Unlike most languages, Go does not use yyyy-MM-dd placeholders — it uses the digits of a fixed reference time. A developer who writes 2021 expecting "the year" gets a layout that matches the literal text 2021 instead, so parsing and formatting break in non-obvious ways. The check is conservative: it inspects only a constant layout and flags the single unambiguous mistake — a four-digit run that is not the reference year 2006. Non-constant layouts (named constants such as time.RFC3339) and correct layouts are never reported.

time.Parse("2021-01-02", s)     // FLAW — 2021 is not the reference year 2006
t.Format("2020/01/02 15:04:05") // FLAW — 2020 is not the reference year

time.Parse("2006-01-02", s)     // OK — reference layout
t.Format(time.RFC3339)          // OK — not a literal

Remediation

Use the Go reference components in the layout: 2006 for the year, 01 for the month, 02 for the day, 15:04:05 for the time. Prefer the predefined constants in the time package where they fit.

References