googleapis / googleapis/google-cloud-rust

Duration try_from string parser accepts malformed signs and flips sign

Open Beginner friendly
#6,713 0 comments 0 reactions 0 assignees View on GitHub
type: bug
Dominant language
Rust
Stars
955
Forks
144
Avg merge
1d 5h
Merged PRs (30d)
279

Description

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In `src/wkt/src/duration.rs`, `Duration::try_from(&str)` parses duration strings:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/wkt/src/duration.rs#L292-L316

The parser strips an initial leading `-` sign into `sign`, then parses the remaining string using `str::parse::` and `str::parse::`.

Because standard integer parsing accepts its own leading sign, malformed strings are accepted with incorrect values:
- `"--1s"`: `sign` is `-1`, remaining is `"-1"`; `(-1) * (-1)` parses as `+1s`.
- `"-+1s"`: parses as `-1s`.
- `"0.-5s"`: parses as `-0.05s`.
- `"5.s"`: parses as `5s`.

Contributor guide

Open the contributing guide

Research direction

Start in src/wkt/src/duration.rs at the Duration::try_from(&str) implementation around lines 292-316, and reproduce the malformed examples listed in the issue. Trace how the leading sign and integer parsing interact; done means malformed signs and fractional forms are rejected while valid duration strings continue to parse correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.