Add validation for out-of-bounds durations and timestamps in ConvertToJson.

PiperOrigin-RevId: 950916413

Author: maskri17

common/values/duration_value.cc

@@ -75,6 +75,8 @@ absl::Status DurationValue::ConvertToJson(
   ABSL_DCHECK_EQ(json->GetDescriptor()->well_known_type(),
                  google::protobuf::Descriptor::WELLKNOWNTYPE_VALUE);
 
+  CEL_RETURN_IF_ERROR(cel::internal::ValidateDuration(NativeValue()));
+
   ValueReflection value_reflection;
   CEL_RETURN_IF_ERROR(value_reflection.Initialize(json->GetDescriptor()));
   value_reflection.SetStringValueFromDuration(json, NativeValue());

common/values/duration_value_test.cc

@@ -12,9 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include "common/values/duration_value.h"
+
 #include <sstream>
 #include <utility>
 
+#include "absl/status/status.h"
 #include "absl/status/status_matchers.h"
 #include "absl/time/time.h"
 #include "common/native_type.h"
@@ -66,6 +69,16 @@ TEST_F(DurationValueTest, ConvertToJson) {
   EXPECT_THAT(*message, EqualsValueTextProto(R"pb(string_value: "0s")pb"));
 }
 
+TEST_F(DurationValueTest, ConvertToJsonOutOfBounds) {
+  auto* message = NewArenaValueMessage();
+  EXPECT_THAT(UnsafeDurationValue(absl::InfiniteDuration())
+                  .ConvertToJson(descriptor_pool(), message_factory(), message),
+              absl_testing::StatusIs(absl::StatusCode::kInvalidArgument));
+  EXPECT_THAT(UnsafeDurationValue(-absl::InfiniteDuration())
+                  .ConvertToJson(descriptor_pool(), message_factory(), message),
+              absl_testing::StatusIs(absl::StatusCode::kInvalidArgument));
+}
+
 TEST_F(DurationValueTest, NativeTypeId) {
   EXPECT_EQ(NativeTypeId::Of(DurationValue(absl::Seconds(1))),
             NativeTypeId::For<DurationValue>());

common/values/timestamp_value.cc

@@ -75,6 +75,8 @@ absl::Status TimestampValue::ConvertToJson(
   ABSL_DCHECK_EQ(json->GetDescriptor()->well_known_type(),
                  google::protobuf::Descriptor::WELLKNOWNTYPE_VALUE);
 
+  CEL_RETURN_IF_ERROR(cel::internal::ValidateTimestamp(NativeValue()));
+
   ValueReflection value_reflection;
   CEL_RETURN_IF_ERROR(value_reflection.Initialize(json->GetDescriptor()));
   value_reflection.SetStringValueFromTimestamp(json, NativeValue());

common/values/timestamp_value_test.cc

@@ -12,8 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include "common/values/timestamp_value.h"
+
 #include <sstream>
 
+#include "absl/status/status.h"
 #include "absl/status/status_matchers.h"
 #include "absl/time/time.h"
 #include "common/native_type.h"
@@ -56,6 +59,16 @@ TEST_F(TimestampValueTest, ConvertToJson) {
                             R"pb(string_value: "1970-01-01T00:00:00Z")pb"));
 }
 
+TEST_F(TimestampValueTest, ConvertToJsonOutOfBounds) {
+  auto* message = NewArenaValueMessage();
+  EXPECT_THAT(UnsafeTimestampValue(absl::InfiniteFuture())
+                  .ConvertToJson(descriptor_pool(), message_factory(), message),
+              absl_testing::StatusIs(absl::StatusCode::kInvalidArgument));
+  EXPECT_THAT(UnsafeTimestampValue(absl::InfinitePast())
+                  .ConvertToJson(descriptor_pool(), message_factory(), message),
+              absl_testing::StatusIs(absl::StatusCode::kInvalidArgument));
+}
+
 TEST_F(TimestampValueTest, NativeTypeId) {
   EXPECT_EQ(
       NativeTypeId::Of(TimestampValue(absl::UnixEpoch() + absl::Seconds(1))),