From ec9a8970ae1e75fd8603d4d54b314a7f079cdcb7 Mon Sep 17 00:00:00 2001
From: Alan Hamlett <alan.hamlett@gmail.com>
Date: Sat, 14 Sep 2024 10:10:01 +0200
Subject: [PATCH] Prevent using future dates for LastSenAt and BackoffAt

---
 cmd/params/params.go      |  6 ++++++
 cmd/params/params_test.go | 26 ++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/cmd/params/params.go b/cmd/params/params.go
index eee50074..c9a971fc 100644
--- a/cmd/params/params.go
+++ b/cmd/params/params.go
@@ -226,8 +226,11 @@ func LoadAPIParams(v *viper.Viper) (API, error) {
 	backoffAtStr := vipertools.GetString(v, "internal.backoff_at")
 	if backoffAtStr != "" {
 		parsed, err := time.Parse(ini.DateFormat, backoffAtStr)
+		// nolint:gocritic
 		if err != nil {
 			log.Warnf("failed to parse backoff_at: %s", err)
+		} else if parsed.After(time.Now()) {
+			backoffAt = time.Now()
 		} else {
 			backoffAt = parsed
 		}
@@ -664,8 +667,11 @@ func LoadOfflineParams(v *viper.Viper) Offline {
 	lastSentAtStr := vipertools.GetString(v, "internal.heartbeats_last_sent_at")
 	if lastSentAtStr != "" {
 		parsed, err := time.Parse(ini.DateFormat, lastSentAtStr)
+		// nolint:gocritic
 		if err != nil {
 			log.Warnf("failed to parse heartbeats_last_sent_at: %s", err)
+		} else if parsed.After(time.Now()) {
+			lastSentAt = time.Now()
 		} else {
 			lastSentAt = parsed
 		}
diff --git a/cmd/params/params_test.go b/cmd/params/params_test.go
index 60ff54d8..9d29ce74 100644
--- a/cmd/params/params_test.go
+++ b/cmd/params/params_test.go
@@ -1771,6 +1771,16 @@ func TestLoadOfflineParams_LastSentAt_Err(t *testing.T) {
 	assert.Zero(t, params.LastSentAt)
 }
 
+func TestLoadOfflineParams_LastSentAtFuture(t *testing.T) {
+	v := viper.New()
+	lastSentAt := time.Now().Add(time.Duration(2) * time.Hour)
+	v.Set("internal.heartbeats_last_sent_at", lastSentAt.Format(inipkg.DateFormat))
+
+	params := cmdparams.LoadOfflineParams(v)
+
+	assert.LessOrEqual(t, params.LastSentAt, time.Now())
+}
+
 func TestLoadOfflineParams_SyncMax(t *testing.T) {
 	v := viper.New()
 	v.Set("sync-offline-activity", 42)
@@ -2148,6 +2158,22 @@ func TestLoadAPIParams_BackoffAtErr(t *testing.T) {
 	}, params)
 }
 
+func TestLoadAPIParams_BackoffAtFuture(t *testing.T) {
+	v := viper.New()
+	backoff := time.Now().Add(time.Duration(2) * time.Hour)
+
+	v.Set("hostname", "my-computer")
+	v.Set("key", "00000000-0000-4000-8000-000000000000")
+	v.Set("internal.backoff_at", backoff.Format(inipkg.DateFormat))
+	v.Set("internal.backoff_retries", "3")
+
+	params, err := cmdparams.LoadAPIParams(v)
+	require.NoError(t, err)
+
+	assert.Equal(t, 3, params.BackoffRetries)
+	assert.LessOrEqual(t, params.BackoffAt, time.Now())
+}
+
 func TestLoadAPIParams_DisableSSLVerify_FlagTakesPrecedence(t *testing.T) {
 	v := viper.New()
 	v.Set("key", "00000000-0000-4000-8000-000000000000")