From 786787cf1f231913a22f9f3c6133146fe3aeb011 Mon Sep 17 00:00:00 2001
From: Chewing_Bever <roosensjef@gmail.com>
Date: Mon, 16 Jan 2023 14:19:16 +0100
Subject: [PATCH] cron: more strict parser

---
 src/cron/c/parse.c    | 14 +++++++++++++-
 src/cron/parse_test.v | 12 ++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/cron/c/parse.c b/src/cron/c/parse.c
index 10df78a..930d9c6 100644
--- a/src/cron/c/parse.c
+++ b/src/cron/c/parse.c
@@ -50,15 +50,27 @@ cron_parse_error ce_parse_range(uint64_t *out, char *s, uint8_t min,
 	// We first iterate over the string to determine whether it contains a slash
 	// and/or a dash. We know the dash can only be valid if it appears before
 	// the slash.
-	while (s[i] != '\0' && slash_index == 0) {
+	while (s[i] != '\0') {
 		if (s[i] == '/') {
+			// At most one slash is allowed
+			if (i == 0 || slash_index != 0) {
+				return cron_parse_invalid_expression;
+			}
+
 			slash_index = i;
 
 			s[i] = '\0';
 		} else if (s[i] == '-') {
+			// At most one dash is allowed, and it must be before the slash
+			if (i == 0 || dash_index != 0 || slash_index != 0) {
+				return cron_parse_invalid_expression;
+			}
+
 			dash_index = i;
 
 			s[i] = '\0';
+		} else if (s[i] != '*' && (s[i] < '0' || s[i] > '9')) {
+			return cron_parse_invalid_expression;
 		}
 
 		i++;
diff --git a/src/cron/parse_test.v b/src/cron/parse_test.v
index a143c73..e42f1d1 100644
--- a/src/cron/parse_test.v
+++ b/src/cron/parse_test.v
@@ -32,6 +32,18 @@ fn test_not_allowed() {
 	res = false
 	parse_expression('0') or { res = true }
 	assert res
+
+	res = false
+	parse_expression('1 2 3 4~9') or { res = true }
+	assert res
+
+	res = false
+	parse_expression('1 1-3-5') or { res = true }
+	assert res
+
+	res = false
+	parse_expression('0 5/2-5') or { res = true }
+	assert res
 }
 
 fn test_leading_star() {