fix: don't parse any number as timestamp in parse_header() (GitoxideLabs#2095)

Author: Byron

gix-date/src/parse.rs

@@ -214,6 +214,9 @@ pub(crate) mod function {
             Some(offset_in_seconds)
         }
 
+        if input.contains(':') {
+            return None;
+        }
         let mut split = input.split_whitespace();
         let seconds = split.next()?;
         let seconds = match seconds.parse::<SecondsSinceUnixEpoch>() {

gix-date/tests/time/parse.rs

@@ -13,6 +13,21 @@ fn special_time_is_ok_for_now() {
     );
 }
 
+#[test]
+fn parse_header_is_not_too_lenient() {
+    let now = SystemTime::now();
+    for not_a_header_str in ["2005-04-07T22:13:09", "2005-04-07 22:13:09"] {
+        assert!(
+            gix_date::parse_header(not_a_header_str).is_none(),
+            "It's not timestamp-like, despite some leniency"
+        );
+        assert!(
+            gix_date::parse(not_a_header_str, Some(now)).is_err(),
+            "it misses the timezone offset, so can't be parsed"
+        );
+    }
+}
+
 #[test]
 fn short() {
     assert_eq!(