fix(fetchers): bound HN timestamp formatting (#109)

Reject Hacker News timestamps beyond year 3000 before running the custom year-subtraction formatter, preventing a CPU-bound DoS from crafted large `time` values in HN item responses. Introduces `format_unix_timestamp_bounded` and skips the `Time:` metadata line when the timestamp is out of range.

Author: chaliy

crates/fetchkit/src/fetchers/hackernews.rs

@@ -19,6 +19,9 @@ const API_TIMEOUT: Duration = Duration::from_secs(10);
 /// Max top-level comments to fetch
 const MAX_COMMENTS: usize = 20;
 
+/// Upper bound for accepted Unix timestamps (3000-01-01T00:00:00Z)
+const MAX_UNIX_TIMESTAMP: u64 = 32_503_680_000;
+
 /// Hacker News fetcher
 ///
 /// Matches `news.ycombinator.com/item?id={id}`, returning structured
@@ -191,8 +194,8 @@ fn format_hn_response(item: &HNItem, comments: &[(HNItem, Vec<HNItem>)]) -> Stri
     if let Some(score) = item.score {
         out.push_str(&format!("- **Score:** {}\n", score));
     }
-    if let Some(time) = item.time {
-        out.push_str(&format!("- **Time:** {}\n", format_unix_timestamp(time)));
+    if let Some(time) = item.time.and_then(format_unix_timestamp_bounded) {
+        out.push_str(&format!("- **Time:** {}\n", time));
     }
     if let Some(descendants) = item.descendants {
         out.push_str(&format!("- **Comments:** {}\n", descendants));
@@ -232,6 +235,15 @@ fn format_hn_response(item: &HNItem, comments: &[(HNItem, Vec<HNItem>)]) -> Stri
     out
 }
 
+/// Format a Unix timestamp as an ISO 8601 UTC date-time string
+fn format_unix_timestamp_bounded(ts: u64) -> Option<String> {
+    if ts > MAX_UNIX_TIMESTAMP {
+        return None;
+    }
+
+    Some(format_unix_timestamp(ts))
+}
+
 /// Format a Unix timestamp as an ISO 8601 UTC date-time string
 fn format_unix_timestamp(ts: u64) -> String {
     let secs = ts % 60;
@@ -466,4 +478,13 @@ mod tests {
         assert_eq!(format_unix_timestamp(0), "1970-01-01T00:00:00Z");
         assert_eq!(format_unix_timestamp(1704067200), "2024-01-01T00:00:00Z");
     }
+
+    #[test]
+    fn test_format_unix_timestamp_bounded() {
+        assert_eq!(
+            format_unix_timestamp_bounded(1704067200),
+            Some("2024-01-01T00:00:00Z".to_string())
+        );
+        assert_eq!(format_unix_timestamp_bounded(u64::MAX), None);
+    }
 }