fix(twitch): reject invalid IRC timestamps (#908)

Author: aiirvizionz

packages/bots/twitch/src/index.ts

@@ -1,6 +1,7 @@
 import { connect as netConnect, type Socket } from "node:net";
 import { connect as tlsConnect } from "node:tls";
 import { defineBot, tokenSetup, type BotCtx, type BotEvent, type BotHandler } from "@profullstack/sh1pt-core";
+import { parseTwitchTimestamp } from "./timestamp.js";
 
 // Twitch bot using Twitch IRC chat over TLS. OAuth token via TWITCH_OAUTH_TOKEN
 // with chat:read and chat:write scopes.
@@ -203,7 +204,7 @@ function toBotEvent(message: IrcMessage, commandPrefix: string): BotEvent | unde
     const channel = toChannelName(message.params[0] ?? "");
     const text = message.trailing ?? "";
     const user = parseUser(message);
-    const timestamp = tagTimestamp(message.tags["tmi-sent-ts"]);
+    const timestamp = parseTwitchTimestamp(message.tags["tmi-sent-ts"]);
     if (text.startsWith(commandPrefix) && text.length > commandPrefix.length) {
       const [command, ...args] = text.slice(commandPrefix.length).trim().split(/\s+/).filter(Boolean);
       if (command) {
@@ -254,12 +255,6 @@ function parseUser(message: IrcMessage): BotEvent["user"] {
   };
 }
 
-function tagTimestamp(value: string | undefined): string {
-  if (!value) return new Date().toISOString();
-  const timestamp = Number(value);
-  return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : new Date().toISOString();
-}
-
 function matches(handler: BotHandler, event: BotEvent): boolean {
   const match = handler.match;
   if (match.type !== event.type) return false;

packages/bots/twitch/src/timestamp.test.ts

@@ -0,0 +1,26 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { parseTwitchTimestamp } from "./timestamp.js";
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("parseTwitchTimestamp", () => {
+  it("converts a decimal millisecond timestamp", () => {
+    expect(parseTwitchTimestamp("1700000000000")).toBe("2023-11-14T22:13:20.000Z");
+  });
+
+  it.each([
+    undefined,
+    "",
+    "1e3",
+    "1.5",
+    "-1",
+    " 1700000000000 ",
+    "9007199254740992",
+    "8640000000000001",
+  ])("falls back to the current time for an invalid timestamp: %s", (value) => {
+    vi.useFakeTimers().setSystemTime(new Date("2026-08-01T18:20:00.000Z"));
+    expect(parseTwitchTimestamp(value)).toBe("2026-08-01T18:20:00.000Z");
+  });
+});

packages/bots/twitch/src/timestamp.ts

@@ -0,0 +1,7 @@
+export function parseTwitchTimestamp(value: string | undefined): string {
+  if (!value || !/^\d+$/.test(value)) return new Date().toISOString();
+  const timestamp = Number(value);
+  if (!Number.isSafeInteger(timestamp)) return new Date().toISOString();
+  const date = new Date(timestamp);
+  return Number.isNaN(date.getTime()) ? new Date().toISOString() : date.toISOString();
+}