Parser accepts invalid timestamp format (e.g., negative milliseconds) without error

[amrutadotorg]

Hello and thank you for creating and maintaining this very useful library!

I'm opening this issue because I've found that webvtt.read() is very permissive with timestamp formats and will silently "fix" and parse invalid timestamps instead of raising an error. This makes it difficult to use the library for strict VTT file validation.

The Problem

According to the WebVTT specification, the timestamp format is HH:MM:SS.sss or MM:SS.sss. The millisecond part must consist of three digits.

However, the library successfully parses a timestamp with an invalid millisecond component like .-004, seemingly correcting it to .004 internally without any warning or error.

Minimal Reproducible Example

1. Create an invalid.vtt file with the following content:

   WEBVTT
   
   00:00:00.-004 --> 00:00:04.300
   This is a test with a malformed timestamp.

2. Run the following Python script:

   import webvtt
   from webvtt.errors import MalformedCaptionError
   
   try:
       captions = webvtt.read("invalid.vtt")
       print("✅ File parsed successfully without errors.")
       # We can even inspect the 'fixed' caption
       for caption in captions:
           print(f"Parsed start time: {caption.start}")
   except MalformedCaptionError as e:
       print(f"❌ Caught expected error: {e}")

Current Behavior

The script runs successfully and produces the following output:
✅ File parsed successfully without errors.
Parsed start time: 00:00:00.004

The library does not raise an exception. It incorrectly parses the file by seemingly ignoring the invalid - character.

Expected Behavior

The script should fail and raise a MalformedCaptionError (or a similar exception) because 00:00:00.-004 is not a valid timestamp. The expected output would be something like:
❌ Caught expected error: [Some descriptive error message about the invalid timestamp]

Why This Is an Issue

For applications that need to validate VTT files (e.g., file upload validators, quality control scripts), this permissive behavior can mask underlying data corruption or errors from the tool that generated the VTT file. It gives a false positive that the file is valid when it is not.

Proposed Solution / Suggestion

The ideal solution would be to make the parser stricter to adhere to the spec. However, to avoid breaking changes for users who rely on the current permissive behavior, perhaps a strict flag could be added?

For example:
webvtt.read('path/to/file.vtt', strict=True)

When strict=True, the parser would perform more rigorous checks on timestamps and other elements. When strict=False (the default), it would retain its current behavior. This would allow the library to serve both users who need to parse potentially messy files and those who need to perform strict validation.

Thank you for your time and for considering this improvement. I believe it would greatly enhance the library's utility.

Environment:

• webvtt-py version: 0.5.1
• Python version: 3.11