cron: more strict parser

src/cron/c/parse.c

@@ -50,15 +50,27 @@ cron_parse_error ce_parse_range(uint64_t *out, char *s, uint8_t min,
 	// We first iterate over the string to determine whether it contains a slash
 	// and/or a dash. We know the dash can only be valid if it appears before
 	// the slash.
-	while (s[i] != '\0' && slash_index == 0) {
+	while (s[i] != '\0') {
 		if (s[i] == '/') {
+			// At most one slash is allowed
+			if (i == 0 || slash_index != 0) {
+				return cron_parse_invalid_expression;
+			}
+
 			slash_index = i;
 
 			s[i] = '\0';
 		} else if (s[i] == '-') {
+			// At most one dash is allowed, and it must be before the slash
+			if (i == 0 || dash_index != 0 || slash_index != 0) {
+				return cron_parse_invalid_expression;
+			}
+
 			dash_index = i;
 
 			s[i] = '\0';
+		} else if (s[i] != '*' && (s[i] < '0' || s[i] > '9')) {
+			return cron_parse_invalid_expression;
 		}
 
 		i++;

src/cron/parse_test.v

@@ -32,6 +32,18 @@ fn test_not_allowed() {
 	res = false
 	parse_expression('0') or { res = true }
 	assert res
+
+	res = false
+	parse_expression('1 2 3 4~9') or { res = true }
+	assert res
+
+	res = false
+	parse_expression('1 1-3-5') or { res = true }
+	assert res
+
+	res = false
+	parse_expression('0 5/2-5') or { res = true }
+	assert res
 }
 
 fn test_leading_star() {