From 34e17ff13ba507a9eaaeb7204e051b4b3133d43e Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Sat, 24 Oct 2026 14:17:45 +0200
Subject: [PATCH] Reject a leading plus sign in SOURCE_DATE_EPOCH

Found while testing crates/doc/src/metadata.rs:108 (stamp_from_env)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/doc/src/metadata.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/crates/doc/src/metadata.rs b/crates/doc/src/metadata.rs
index 1a84ef219..151365c5d 100644
--- a/crates/doc/src/metadata.rs
+++ b/crates/doc/src/metadata.rs
@@ -105,7 +105,13 @@ fn pinned_or(get: impl Fn(&str) -> Option<String>, clock: impl Fn() -> Option<i6
 /// seconds since the epoch. `None` when it is unset, blank, negative or not an integer, and then
 /// the clock decides — an export is never refused over the environment.
 fn stamp_from_env(get: impl Fn(&str) -> Option<String>) -> Option<i64> {
-    get("SOURCE_DATE_EPOCH")?.trim().parse::<i64>().ok().filter(|t| *t >= 0)
+    let value = get("SOURCE_DATE_EPOCH")?;
+    let value = value.trim();
+    // `i64::from_str` also takes a leading `+`, which `date +%s` never prints.
+    if value.is_empty() || !value.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    value.parse::<i64>().ok()
 }
 
 /// The current time as Unix seconds (UTC); `None` where the platform has no clock (the web build).
@@ -193,7 +199,7 @@ mod tests {
         assert_eq!(stamp_from_env(env(Some("1791208980"))), Some(1_791_208_980));
         assert_eq!(stamp_from_env(env(Some("0"))), Some(0));
         assert_eq!(stamp_from_env(env(Some("  1791208980  "))), Some(1_791_208_980));
-        for bad in ["", "   ", "-1", "later", "1791208980.5", "1e9", "99999999999999999999"] {
+        for bad in ["", "   ", "-1", "later", "1791208980.5", "1e9", "+1791208980", "+0", "99999999999999999999"] {
             assert_eq!(stamp_from_env(env(Some(bad))), None, "{bad:?}");
         }
         assert_eq!(stamp_from_env(env(None)), None, "unset");