diff --git a/src/main/java/com/clearfolio/viewer/analytics/KpiSnapshotLedger.java b/src/main/java/com/clearfolio/viewer/analytics/KpiSnapshotLedger.java index f5cbde5d..29370df1 100644 --- a/src/main/java/com/clearfolio/viewer/analytics/KpiSnapshotLedger.java +++ b/src/main/java/com/clearfolio/viewer/analytics/KpiSnapshotLedger.java @@ -213,7 +213,11 @@ private static int integer(String field) { private static double rate(String field) { try { - return Double.parseDouble(field); + double value = Double.parseDouble(field); + if (!Double.isFinite(value) || value < 0.0 || value > 1.0) { + throw invalidLine(); + } + return value; } catch (NumberFormatException ex) { throw invalidLine(ex); } @@ -224,7 +228,11 @@ private static Long nullableLong(String field) { return null; } try { - return Long.parseLong(field); + long value = Long.parseLong(field); + if (value < 0L) { + throw invalidLine(); + } + return value; } catch (NumberFormatException ex) { throw invalidLine(ex); } diff --git a/src/test/java/com/clearfolio/viewer/analytics/KpiSnapshotLedgerTest.java b/src/test/java/com/clearfolio/viewer/analytics/KpiSnapshotLedgerTest.java index d42349fd..a91f129e 100644 --- a/src/test/java/com/clearfolio/viewer/analytics/KpiSnapshotLedgerTest.java +++ b/src/test/java/com/clearfolio/viewer/analytics/KpiSnapshotLedgerTest.java @@ -82,7 +82,13 @@ void rejectsInvalidPersistedLedgerLines() throws Exception { assertInvalidLedger(snapshotLine().replace(NOW.toString(), "not-instant")); assertInvalidLedger(snapshotLine().replace("\t2\t", "\tnot-int\t")); assertInvalidLedger(snapshotLine().replace("\t0.5\t", "\tnot-rate\t")); + assertInvalidLedger(snapshotLine().replace("\t0.5\t", "\tNaN\t")); + assertInvalidLedger(snapshotLine().replace("\t0.5\t", "\tInfinity\t")); + assertInvalidLedger(snapshotLine().replace("\t0.5\t", "\t-Infinity\t")); + assertInvalidLedger(snapshotLine().replace("\t0.5\t", "\t-0.01\t")); + assertInvalidLedger(snapshotLine().replace("\t0.5\t", "\t1.01\t")); assertInvalidLedger(snapshotLine().replace("\t123", "\tnot-long")); + assertInvalidLedger(snapshotLine().replace("\t123", "\t-1")); assertInvalidLedger(snapshotLine().replace(encoded("tenant-a"), "!")); }