lgtm

server-rs/src/parsing/bounds.rs

@@ -80,6 +80,28 @@ pub fn parse_bounds(bounds_str: &str) -> Result<(f64, f64, f64, f64), (StatusCod
 
     let (south, west, north, east) = (parts[0], parts[1], parts[2], parts[3]);
 
+    if ![south, west, north, east]
+        .iter()
+        .all(|value| value.is_finite())
+    {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "Invalid bounds: values must be finite numbers".into(),
+        ));
+    }
+    if !(-90.0..=90.0).contains(&south) || !(-90.0..=90.0).contains(&north) {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "Invalid bounds: latitude must be between -90 and 90".into(),
+        ));
+    }
+    if !(-180.0..=180.0).contains(&west) || !(-180.0..=180.0).contains(&east) {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "Invalid bounds: longitude must be between -180 and 180".into(),
+        ));
+    }
+
     // Validate that bounds are not inverted
     if south > north {
         return Err((
@@ -112,8 +134,8 @@ mod tests {
             (1.0, 2.0, 3.0, 4.0)
         );
         assert_eq!(
-            parse_bounds("-51.5, -0.1, 51.6, 0.2").unwrap(),
-            (-51.5, -0.1, 51.6, 0.2)
+            parse_bounds("51.5, -0.1, 51.6, 0.2").unwrap(),
+            (51.5, -0.1, 51.6, 0.2)
         );
     }
 
@@ -133,6 +155,18 @@ mod tests {
         assert!(parse_bounds("51.0,0.5,52.0,-0.5").is_err());
     }
 
+    #[test]
+    fn parse_bounds_rejects_non_finite_values() {
+        assert!(parse_bounds("NaN,0,1,1").is_err());
+        assert!(parse_bounds("0,0,inf,1").is_err());
+    }
+
+    #[test]
+    fn parse_bounds_accepts_world_sized_bounds() {
+        assert!(parse_bounds("-90,-180,90,180").is_ok());
+        assert!(parse_bounds("35.8,-45.0,67.2,45.0").is_ok());
+    }
+
     #[test]
     fn h3_cell_bounds_applies_buffer() {
         let cell = h3o::CellIndex::from_str("8928308280fffff").unwrap();