Reject '+' sign in comment parse_link thread ids (#1740)

Found while testing crates/engine/src/cmd/comment.rs:55 (parse_link)

Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
This commit is contained in:
NetterSilver
2026-10-31 10:37:22 -04:00
committed by GitHub
co-authored by Claude Haiku 5.5
parent 9a7e5d1a16
commit 556d44d47a
+15 -1
View File
@@ -52,7 +52,12 @@ pub fn link(id: u64) -> String {
/// The thread id in a link (or a bare id).
pub fn parse_link(s: &str) -> Option<u64> {
let s = s.trim();
s.strip_prefix(LINK_PREFIX).unwrap_or(s).trim_end_matches('/').parse().ok()
let s = s.strip_prefix(LINK_PREFIX).unwrap_or(s).trim_end_matches('/');
// Digits only: `u64::parse` would also accept a leading '+'.
if !s.bytes().all(|b| b.is_ascii_digit()) {
return None;
}
s.parse().ok()
}
/// Which threads a list shows.
@@ -997,6 +1002,15 @@ mod tests {
use crate::Session;
#[test]
fn parse_link_rejects_sign() {
assert_eq!(super::parse_link("+5"), None);
assert_eq!(super::parse_link("figcraft://comment/+5"), None);
assert_eq!(super::parse_link(""), None);
assert_eq!(super::parse_link("5"), Some(5));
assert_eq!(super::parse_link("figcraft://comment/5/"), Some(5));
}
#[test]
fn comment_thread_lifecycle_and_anchoring() {
let mut s = Session::new();