feat(patch): strict parsing mode (the git-apply behavior)

Adds `from_str_strict`/`from_bytes_strict` that reject
orphaned hunk headers hidden behind trailing content
This matches `git apply` behavior.
Plain trailing junk is still accepted.

The default `from_str`/`from_bytes` remain permissive
(the GNU patch behavior ).

Author: weihanglo

src/patch/error.rs

@@ -107,6 +107,9 @@ pub(crate) enum ParsePatchErrorKind {
 
     /// Missing newline at end of line.
     MissingNewline,
+
+    /// Orphaned hunk header found after trailing content.
+    OrphanedHunkHeader,
 }
 
 impl fmt::Display for ParsePatchErrorKind {
@@ -132,6 +135,7 @@ impl fmt::Display for ParsePatchErrorKind {
             Self::UnexpectedNoNewlineMarker => "unexpected 'No newline at end of file' line",
             Self::UnexpectedHunkLine => "unexpected line in hunk body",
             Self::MissingNewline => "missing newline",
+            Self::OrphanedHunkHeader => "orphaned hunk header after trailing content",
         };
         write!(f, "{msg}")
     }

src/patch/mod.rs

@@ -16,6 +16,30 @@ use crate::utils::{byte_needs_quoting, fmt_escaped_byte, write_escaped_byte};
 const NO_NEWLINE_AT_EOF: &str = "\\ No newline at end of file";
 
 /// Representation of all the differences between two files
+///
+/// # Parsing modes
+///
+/// `Patch` provides two parsing modes with different strictness levels,
+/// modeled after the behavior of GNU patch and `git apply`:
+///
+/// | Scenario                          | GNU patch   | git apply | [`from_str`] | [`from_str_strict`] |
+/// |-----------------------------------|-------------|-----------|--------------|---------------------|
+/// | Junk after all hunks are complete | Ignores     | Ignores   | Ignores      | Ignores             |
+/// | Junk between hunks                | Ignores[^1] | Errors    | Ignores[^1]  | Errors              |
+///
+/// [^1]: "Ignores" here means silently stopping at the junk.
+///     Only hunks before it are parsed; later hunks are dropped.
+///
+/// [`from_str`] and [`from_bytes`] follow GNU patch behavior,
+/// silently ignoring non-patch content after a hunk's line counts are satisfied.
+///
+/// [`from_str_strict`] and [`from_bytes_strict`] follow `git apply` behavior,
+/// additionally rejecting orphaned hunk headers hidden behind trailing content.
+///
+/// [`from_str`]: Patch::from_str
+/// [`from_bytes`]: Patch::from_bytes
+/// [`from_str_strict`]: Patch::from_str_strict
+/// [`from_bytes_strict`]: Patch::from_bytes_strict
 #[derive(PartialEq, Eq)]
 pub struct Patch<'a, T: ToOwned + ?Sized> {
     // TODO GNU patch is able to parse patches without filename headers.
@@ -108,13 +132,31 @@ impl<'a> Patch<'a, str> {
     pub fn from_str(s: &'a str) -> Result<Patch<'a, str>, ParsePatchError> {
         parse::parse(s)
     }
+
+    /// Parse a `Patch` from a string in strict mode
+    ///
+    /// Unlike [`Patch::from_str`],
+    /// this rejects orphaned hunk headers hidden after trailing content,
+    /// matching `git apply` behavior.
+    pub fn from_str_strict(s: &'a str) -> Result<Patch<'a, str>, ParsePatchError> {
+        parse::parse_strict(s)
+    }
 }
 
 impl<'a> Patch<'a, [u8]> {
     /// Parse a `Patch` from bytes
     pub fn from_bytes(s: &'a [u8]) -> Result<Patch<'a, [u8]>, ParsePatchError> {
         parse::parse_bytes(s)
     }
+
+    /// Parse a `Patch` from bytes in strict mode
+    ///
+    /// Unlike [`Patch::from_bytes`],
+    /// this rejects orphaned hunk headers hidden after trailing content,
+    /// matching `git apply` behavior.
+    pub fn from_bytes_strict(s: &'a [u8]) -> Result<Patch<'a, [u8]>, ParsePatchError> {
+        parse::parse_bytes_strict(s)
+    }
 }
 
 impl<T: ToOwned + ?Sized> Clone for Patch<'_, T> {

src/patch/parse.rs

@@ -65,6 +65,19 @@ pub fn parse(input: &str) -> Result<Patch<'_, str>> {
     ))
 }
 
+pub fn parse_strict(input: &str) -> Result<Patch<'_, str>> {
+    let mut parser = Parser::new(input);
+    let header = patch_header(&mut parser)?;
+    let hunks = hunks(&mut parser)?;
+    reject_orphaned_hunk_headers(&mut parser)?;
+
+    Ok(Patch::new(
+        header.0.map(convert_cow_to_str),
+        header.1.map(convert_cow_to_str),
+        hunks,
+    ))
+}
+
 pub fn parse_bytes(input: &[u8]) -> Result<Patch<'_, [u8]>> {
     let mut parser = Parser::new(input);
     let header = patch_header(&mut parser)?;
@@ -73,6 +86,15 @@ pub fn parse_bytes(input: &[u8]) -> Result<Patch<'_, [u8]>> {
     Ok(Patch::new(header.0, header.1, hunks))
 }
 
+pub fn parse_bytes_strict(input: &[u8]) -> Result<Patch<'_, [u8]>> {
+    let mut parser = Parser::new(input);
+    let header = patch_header(&mut parser)?;
+    let hunks = hunks(&mut parser)?;
+    reject_orphaned_hunk_headers(&mut parser)?;
+
+    Ok(Patch::new(header.0, header.1, hunks))
+}
+
 // This is only used when the type originated as a utf8 string
 fn convert_cow_to_str(cow: Cow<'_, [u8]>) -> Cow<'_, str> {
     match cow {
@@ -154,6 +176,20 @@ fn verify_hunks_in_order<T: ?Sized>(hunks: &[Hunk<'_, T>]) -> bool {
     true
 }
 
+/// Scans remaining lines for orphaned `@@ ` hunk headers.
+///
+/// In strict mode (git-apply behavior), trailing junk is allowed but
+/// an `@@ ` line hiding behind that junk indicates a lost hunk.
+fn reject_orphaned_hunk_headers<T: Text + ?Sized>(parser: &mut Parser<'_, T>) -> Result<()> {
+    while let Some(line) = parser.peek() {
+        if line.starts_with("@@ ") {
+            return Err(parser.error(ParsePatchErrorKind::OrphanedHunkHeader));
+        }
+        parser.next()?;
+    }
+    Ok(())
+}
+
 fn hunks<'a, T: Text + ?Sized>(parser: &mut Parser<'a, T>) -> Result<Vec<Hunk<'a, T>>> {
     let mut hunks = Vec::new();
     // Following GNU patch behavior: stop at non-@@ content.

src/patch/tests.rs

@@ -1,5 +1,5 @@
 use super::error::ParsePatchErrorKind;
-use super::parse::{parse, parse_bytes};
+use super::parse::{parse, parse_bytes, parse_bytes_strict, parse_strict};
 
 #[test]
 fn trailing_garbage_after_complete_hunk() {
@@ -141,8 +141,6 @@ trailing garbage
 
 // Strict mode (git-apply behavior): rejects orphaned hunk headers
 // hidden behind trailing content, but allows plain trailing junk.
-// Currently all use permissive `parse`; the next commit introduces
-// `parse_strict` and updates assertions where behavior diverges.
 mod strict_mode {
     use super::*;
 
@@ -157,7 +155,7 @@ mod strict_mode {
 +new
 this is trailing garbage
 ";
-        let patch = parse(s).unwrap();
+        let patch = parse_strict(s).unwrap();
         assert_eq!(patch.hunks().len(), 1);
     }
 
@@ -171,15 +169,14 @@ this is trailing garbage
 +new
 this is trailing garbage
 ";
-        let patch = parse_bytes(&s[..]).unwrap();
+        let patch = parse_bytes_strict(&s[..]).unwrap();
         assert_eq!(patch.hunks().len(), 1);
     }
 
     #[test]
     fn orphaned_hunk_header_after_junk() {
-        // Junk between hunks hides the second @@ — strict should reject this
+        // Junk between hunks hides the second @@ — strict rejects this
         // since git apply errors with "patch fragment without header".
-        // Currently permissive: succeeds with 1 hunk.
         let s = "\
 --- a/file.txt
 +++ b/file.txt
@@ -191,8 +188,10 @@ not a hunk line
 -b
 +B
 ";
-        let patch = parse(s).unwrap();
-        assert_eq!(patch.hunks().len(), 1);
+        assert_eq!(
+            parse_strict(s).unwrap_err().kind,
+            ParsePatchErrorKind::OrphanedHunkHeader,
+        );
     }
 
     #[test]
@@ -204,7 +203,7 @@ not a hunk line
 -old
 +new
 ";
-        let patch = parse(s).unwrap();
+        let patch = parse_strict(s).unwrap();
         assert_eq!(patch.hunks().len(), 1);
     }
 
@@ -220,7 +219,7 @@ not a hunk line
 -b
 +B
 ";
-        let patch = parse(s).unwrap();
+        let patch = parse_strict(s).unwrap();
         assert_eq!(patch.hunks().len(), 2);
     }
 
@@ -236,7 +235,7 @@ garbage before hunk complete
  line 3
 ";
         assert_eq!(
-            parse(s).unwrap_err().kind,
+            parse_strict(s).unwrap_err().kind,
             ParsePatchErrorKind::UnexpectedHunkLine,
         );
     }