From 8c4e496d9c207ecac11f96a672ee3db90db9f657 Mon Sep 17 00:00:00 2001
From: OpenDeernet <OpenDeernet@users.noreply.github.com>
Date: Thu, 5 Nov 2026 10:46:05 +0800
Subject: [PATCH] fix(status): reject codes outside 100-999 with 400 instead of
 200

Fixes #35
---
 src/handlers/status.rs |  5 +++++
 src/tests/status.rs    | 22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/src/handlers/status.rs b/src/handlers/status.rs
index e89c75b..7b958cb 100644
--- a/src/handlers/status.rs
+++ b/src/handlers/status.rs
@@ -41,6 +41,11 @@ fn parse_weighted_codes(codes_str: &str) -> Result<Vec<WeightedChoice>, String>
         };
 
         let code = code_str.parse::<u16>().map_err(|_| "Invalid status code")?;
+        // Only 100-999 can be sent as a real status line; anything else would
+        // otherwise fall back to 200 further down.
+        if StatusCode::from_u16(code).is_err() {
+            return Err("Invalid status code".to_string());
+        }
 
         if weight < 0.0 {
             return Err("Weight cannot be negative".to_string());
diff --git a/src/tests/status.rs b/src/tests/status.rs
index 9140baa..7513338 100644
--- a/src/tests/status.rs
+++ b/src/tests/status.rs
@@ -121,3 +121,25 @@ async fn response_headers_post_sets_headers() {
         "bar"
     );
 }
+
+/// Codes outside 100-999 can't be sent as a real status, so they are
+/// rejected like any other invalid code instead of falling back to 200.
+#[actix_web::test]
+async fn status_out_of_range_code_is_bad_request() {
+    let app = test::init_service(create_app(cfg())).await;
+    for uri in [
+        "/status/99",
+        "/status/1000",
+        "/status/0",
+        "/status/200,1000",
+    ] {
+        for method in [actix_web::http::Method::GET, actix_web::http::Method::POST] {
+            let req = test::TestRequest::default()
+                .method(method.clone())
+                .uri(uri)
+                .to_request();
+            let resp = test::call_service(&app, req).await;
+            assert_eq!(resp.status(), StatusCode::BAD_REQUEST, "{method} {uri}");
+        }
+    }
+}