fix(core): reject non-digit origin port prefixes

crates/originweave-core/src/lib.rs

@@ -165,6 +165,9 @@ fn parse_bracketed_ipv6(authority: &str) -> Result<(String, Option<u16>, bool),
 }
 
 fn parse_port(port_text: &str) -> Result<u16, OriginError> {
+    if port_text.is_empty() || !port_text.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(OriginError::InvalidPort);
+    }
     let port = port_text
         .parse::<u16>()
         .map_err(|_error| OriginError::InvalidPort)?;

crates/originweave-core/tests/origin_port_syntax.rs

@@ -0,0 +1,18 @@
+use originweave_core::{Origin, OriginError};
+
+#[test]
+fn origin_rejects_non_digit_port_prefixes() {
+    for input in [
+        "https://example.com:+443",
+        "https://example.com:+8443",
+        "http://localhost:+80",
+        "http://127.0.0.1:+8080",
+        "https://[2001:db8::1]:+443",
+    ] {
+        assert_eq!(
+            Origin::parse(input),
+            Err(OriginError::InvalidPort),
+            "input={input}"
+        );
+    }
+}