From 4559a8d736557a77919166ecb6878a4aa7fba28b Mon Sep 17 00:00:00 2001
From: Alix-007 <li.long15@xydigit.com>
Date: Wed, 17 Jun 2026 12:00:53 +0800
Subject: [PATCH] fix(cron): reject invalid absolute timestamps (#93903)

* fix(cron): reject invalid absolute timestamps

* fix(cron): preserve ISO end of day

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
---
 src/cron/parse.test.ts | 23 +++++++++++++++++++++
 src/cron/parse.ts      | 46 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)

diff --git a/src/cron/parse.test.ts b/src/cron/parse.test.ts
index 1c9bbd90019a..aff334927906 100644
--- a/src/cron/parse.test.ts
+++ b/src/cron/parse.test.ts
@@ -10,4 +10,27 @@ describe("parseAbsoluteTimeMs", () => {
   it("rejects digit-only timestamps outside the Date range", () => {
     expect(parseAbsoluteTimeMs(String(Number.MAX_SAFE_INTEGER))).toBeNull();
   });
+
+  it("parses ISO timestamps with UTC defaults and explicit offsets", () => {
+    expect(parseAbsoluteTimeMs("2026-02-28")).toBe(Date.parse("2026-02-28T00:00:00Z"));
+    expect(parseAbsoluteTimeMs("2026-02-28T12:34:56.789Z")).toBe(
+      Date.parse("2026-02-28T12:34:56.789Z"),
+    );
+    expect(parseAbsoluteTimeMs("2026-02-28T24:00:00Z")).toBe(Date.parse("2026-02-28T24:00:00Z"));
+    expect(parseAbsoluteTimeMs("2026-02-28T12:34:56+08:00")).toBe(
+      Date.parse("2026-02-28T12:34:56+08:00"),
+    );
+  });
+
+  it.each([
+    "2023-02-29",
+    "2026-02-31",
+    "2026-02-31T00:00:00Z",
+    "2026-04-31T12:34:56Z",
+    "2026-01-01T25:00:00Z",
+    "December 17, 2026 03:24:00",
+    "2026/12/17",
+  ])("rejects invalid absolute timestamp %s", (input) => {
+    expect(parseAbsoluteTimeMs(input)).toBeNull();
+  });
 });
diff --git a/src/cron/parse.ts b/src/cron/parse.ts
index b748bc38922c..4f8db97d82a8 100644
--- a/src/cron/parse.ts
+++ b/src/cron/parse.ts
@@ -4,6 +4,8 @@ import { parseStrictPositiveInteger } from "../infra/parse-finite-number.js";
 const ISO_TZ_RE = /(Z|[+-]\d{2}:?\d{2})$/i;
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 const ISO_DATE_TIME_RE = /^\d{4}-\d{2}-\d{2}T/;
+const ISO_ABSOLUTE_RE =
+  /^(\d{4})-(\d{2})-(\d{2})(?:T(\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?(?:[Zz]|[+-]\d{2}:?\d{2})?)?$/;
 
 function normalizeUtcIso(raw: string) {
   if (ISO_TZ_RE.test(raw)) {
@@ -18,6 +20,47 @@ function normalizeUtcIso(raw: string) {
   return raw;
 }
 
+function isValidIsoAbsolute(raw: string) {
+  const match = ISO_ABSOLUTE_RE.exec(raw);
+  if (!match) {
+    return false;
+  }
+
+  const [
+    ,
+    yearRaw,
+    monthRaw,
+    dayRaw,
+    hourRaw = "0",
+    minuteRaw = "0",
+    secondRaw = "0",
+    fractionRaw,
+  ] = match;
+  const year = Number(yearRaw);
+  const month = Number(monthRaw);
+  const day = Number(dayRaw);
+  const hour = Number(hourRaw);
+  const minute = Number(minuteRaw);
+  const second = Number(secondRaw);
+  const millisecond = fractionRaw ? Number(fractionRaw.slice(1, 4).padEnd(3, "0")) : 0;
+  const isEndOfDay = hour === 24 && minute === 0 && second === 0 && millisecond === 0;
+
+  // Date.parse rolls invalid calendar dates; cron must reject them before scheduling.
+  const probe = new Date(0);
+  probe.setUTCFullYear(year, month - 1, day);
+  probe.setUTCHours(isEndOfDay ? 0 : hour, minute, second, millisecond);
+
+  return (
+    probe.getUTCFullYear() === year &&
+    probe.getUTCMonth() === month - 1 &&
+    probe.getUTCDate() === day &&
+    probe.getUTCHours() === (isEndOfDay ? 0 : hour) &&
+    probe.getUTCMinutes() === minute &&
+    probe.getUTCSeconds() === second &&
+    probe.getUTCMilliseconds() === millisecond
+  );
+}
+
 /** Parses absolute cron timestamps from epoch milliseconds or ISO-like strings normalized to UTC. */
 export function parseAbsoluteTimeMs(input: string): number | null {
   const raw = input.trim();
@@ -31,6 +74,9 @@ export function parseAbsoluteTimeMs(input: string): number | null {
     }
     return null;
   }
+  if (!isValidIsoAbsolute(raw)) {
+    return null;
+  }
   const parsed = Date.parse(normalizeUtcIso(raw));
   return Number.isFinite(parsed) ? parsed : null;
 }