fix(destination): reject non-digit proxy port prefixes

CHANGELOG.md

@@ -67,6 +67,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Security
 
+- Explicit proxy server identifiers require ASCII decimal port tokens before numeric range parsing, preventing Rust-specific leading-plus spellings from widening proxy authority.
 - Raw page content cannot become a trusted instruction.
 - Raw secrets are rejected and secret-capable actions require an opaque broker handle.
 - Crawler mode is read-only, must pair with the public-crawl purpose, and fails closed without an applicable robots-policy decision.

crates/originweave-destination/src/proxy.rs

@@ -446,6 +446,9 @@ fn explicit_port(authority: &str) -> Result<Option<u16>, ProxyServerError> {
         port
     };
 
+    if !port_text.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(ProxyServerError::InvalidIdentifier);
+    }
     let port = port_text
         .parse::<u16>()
         .map_err(|_error| ProxyServerError::InvalidIdentifier)?;

crates/originweave-destination/tests/proxy_port_syntax.rs

@@ -0,0 +1,29 @@
+use originweave_destination::{ProxyServer, ProxyServerError};
+
+#[test]
+fn proxy_server_rejects_non_digit_port_prefixes() {
+    for input in [
+        "proxy.example:+8080",
+        "http://proxy.example:+8080",
+        "https://proxy.example:+8443",
+        "socks5://proxy.example:+1080",
+        "https://[2001:db8::1]:+8443",
+    ] {
+        assert_eq!(
+            ProxyServer::parse(input),
+            Err(ProxyServerError::InvalidIdentifier),
+            "input={input}",
+        );
+    }
+}
+
+#[test]
+fn proxy_server_rejects_decimal_ports_outside_u16_range() {
+    for input in ["proxy.example:65536", "https://[2001:db8::1]:65536"] {
+        assert_eq!(
+            ProxyServer::parse(input),
+            Err(ProxyServerError::InvalidIdentifier),
+            "input={input}",
+        );
+    }
+}