From a1051260635487670f28188156caec4f6dfe40fe Mon Sep 17 00:00:00 2001
From: neil <gitsrc@neilpang.com>
Date: Sat, 4 Jul 2026 19:14:36 +0800
Subject: [PATCH] _date2time: pass date via argv to python to prevent code
 injection (#6463) https://github.com/acmesh-official/acme.sh/issues/6463

---
 acme.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index 6bf59fbb..148945b9 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1895,12 +1895,13 @@ _date2time() {
   if gdate -u -d "$(echo "$1" | tr -d "Z" | tr "T" ' ')" +"%s" 2>/dev/null; then
     return
   fi
-  #Omnios
-  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%d %H:%M:%S\").replace(tzinfo=datetime.timezone.utc).timestamp()))" 2>/dev/null; then
+  #Omnios. Pass the date as argv (sys.argv[1]) instead of interpolating it into
+  #the -c program text, so a quote in the input cannot inject Python code.
+  if python3 -c "import datetime,sys; print(int(datetime.datetime.strptime(sys.argv[1], \"%Y-%m-%d %H:%M:%S\").replace(tzinfo=datetime.timezone.utc).timestamp()))" "$1" 2>/dev/null; then
     return
   fi
   #Omnios
-  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%dT%H:%M:%SZ\").replace(tzinfo=datetime.timezone.utc).timestamp()))" 2>/dev/null; then
+  if python3 -c "import datetime,sys; print(int(datetime.datetime.strptime(sys.argv[1], \"%Y-%m-%dT%H:%M:%SZ\").replace(tzinfo=datetime.timezone.utc).timestamp()))" "$1" 2>/dev/null; then
     return
   fi
   _err "Cannot parse _date2time $1"
@@ -2992,6 +2993,11 @@ _initAPI() {
     return 0
   fi
   _err "Cannot init API for $_api_server"
+  if [ "$_api_server" = "$CA_ZEROSSL" ]; then
+    _info "$(__green "If this host is IPv6-only: ZeroSSL currently has no IPv6 endpoint.")"
+    _info "$(__green "Try another CA, e.g.: $PROJECT_ENTRY --set-default-ca --server letsencrypt")"
+    _info "See: $(__green "https://github.com/acmesh-official/acme.sh/issues/6872")"
+  fi
   return 1
 }