Date-Time validation allows non RFC3339 strings

[AryaSvitkona]

In https://github.com/thephpleague/openapi-psr7-validator/blob/master/src/Schema/TypeFormats/StringDateTime.php the four allowed formats are declared, which a passed date-time string should match.

According to the DateTimeInterface documentation the P in Y-m-d\TH:i:sP stands for

Difference to Greenwich time (GMT) with colon between hours and minutes

where an O would stand for

Difference to Greenwich time (GMT) without colon between hours and minutes

If I pass 2025-05-28T17:39:00+0200 (without colon) the method still returns true, since it would match the first format Y-m-d\TH:i:sP.
Why? I expected to return "false" since it does not match one of the declared formats.

I also checked the RFC3339 reference which leads to timezone offset with colons.

[marcosimbuerger]

The reason is that DateTime formatting and parsing behave differently in PHP.

PHP's DateTime::format() and DateTime::createFromFormat() use the same format specifiers, but they do not apply them with the same strictness - especially for timezone offsets.

When outputting a date, format() clearly distinguishes between O and P.

See: https://www.php.net/manual/en/datetime.format.php

• O outputs the UTC offset without a colon, e.g. +0200
• P outputs the UTC offset with a colon, e.g. +02:00

$date = new DateTime('2026-04-10T08:00:00+02:00');

echo $date->format('O'); // +0200
echo $date->format('P'); // +02:00

When parsing a date string, createFromFormat() does not distinguish between O and P.

See: https://www.php.net/manual/en/datetimeimmutable.createfromformat.php

Both specifiers accept either with or without the colon:

// P declared, but +0200 (no colon) passed — still returns a valid object
$date1 = DateTime::createFromFormat('Y-m-d\TH:i:sP', '2026-04-10T08:00:00+0200');
var_dump($date1); // object(DateTime)

// O declared, but +02:00 (with colon) passed — still returns a valid object
$date2 = DateTime::createFromFormat('Y-m-d\TH:i:sO', '2026-04-10T08:00:00+02:00');
var_dump($date2); // object(DateTime)

The root cause lies in PHP's underlying date parsing library, timelib. Internally, timezone offsets are matched by a single re2c lexer rule in parse_date.re:

tzcorrection = "GMT"? [+-] hour24 ":"? minute?;

The ":"? makes the colon entirely optional at the lexer level. Both O and P in createFromFormat() invoke this same rule — there is no separate parsing path for "with colon" vs "without colon".

To strictly validate whether an incoming date string uses +0200 or +02:00, we cannot rely on createFromFormat() alone. We need to complement it with an explicit regex check. Example:

/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,6})?(Z|[+\-]\d{2}:\d{2})$/

[AryaSvitkona]

I just run in the same error in on of our projects and solved exactly with the same regex ;)

But, since this package validates against official standards it should be strict and not loosly.
I will create a pull request with the regex as more strict solution in the next few days and maybe the maintainers will approve it.