Timezone conversion uses IANA library; no manual offset arithmetic
Why it matters
Manual offset arithmetic like date.getTime() + 5 * 3600000 hard-codes a fixed UTC offset and silently breaks twice a year during DST transitions. CWE-682 (Incorrect Calculation) and ISO 25010 functional correctness both flag this: New York is UTC-5 in January and UTC-4 in July — a hard-coded -5 produces a one-hour appointment time error for every booking during EDT. IANA libraries carry the full historical and future timezone rule database; manual arithmetic carries none of it. A single DST-related booking error can generate dozens of no-shows before anyone notices the pattern.
Severity rationale
High because manual offset arithmetic silently produces one-hour appointment time errors on every DST transition, affecting all bookings during a roughly five-month EDT window without any visible error.
Remediation
Replace all manual offset arithmetic with calls to an IANA-aware library. Install date-fns-tz (or luxon) and use its conversion functions exclusively throughout src/lib/.
// Bad — breaks during DST
const local = new Date(utc.getTime() - 5 * 3_600_000) // hardcoded EST offset
// Good — IANA library handles DST automatically
import { toZonedTime, fromZonedTime } from 'date-fns-tz'
const tz = 'America/New_York'
const localTime = toZonedTime(utcDate, tz) // display: UTC → local
const utcTime = fromZonedTime(localDate, tz) // store: local → UTC
Search src/ for the pattern * 3600000 or * 3_600_000 near timezone variables and replace each instance. Confirm date-fns-tz or equivalent appears in package.json dependencies, not just devDependencies.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Calendar & Availability Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-682 — Incorrect Calculation — manual offset arithmetic produces wrong times during DST transitions
- iso-25010:2011 · functional-correctness — Functional Correctness — timezone conversion must produce accurate results across DST boundaries
Taxons
History
- 2026-04-18·v1.0.0·Initial import from booking-calendar-availability·automated