fix: reject malformed honeypot timestamps

Author: nickmoreton

CHANGELOG

@@ -4,6 +4,7 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+- Ignore malformed honeypot timestamps instead of raising an exception.
 - Update contributor branch workflow guidance and PR CI to target `main`.
 
 ## [1.3.0] - 2026-04-21

tests/test_form.py

@@ -102,6 +102,13 @@ def test_form_submission_is_ignored_when_honeypot_time_is_too_short(self):
         self.assert_submission_count(0)
         self.assertContains(resp, "Thank you for your message")
 
+    def test_form_submission_is_ignored_when_honeypot_time_is_invalid(self):
+        for value in ("", "not-a-timestamp"):
+            with self.subTest(value=value):
+                resp = self.post_form(whf_time=value)
+                self.assert_submission_count(0)
+                self.assertContains(resp, "Thank you for your message")
+
     def test_form_submission_is_ignored_when_honeypot_text_is_filled(self):
         """
         Test that a form submission is unsuccessful

tests/test_methods.py

@@ -29,3 +29,14 @@ def test_time_diff_thresholds(self, mock_time):
         for label, submitted_time, expected in cases:
             with self.subTest(label=label):
                 self.assertEqual(self.form.time_diff(submitted_time, self.interval), expected)
+
+    def test_time_diff_rejects_invalid_values(self):
+        cases = [
+            ("empty string", ""),
+            ("non-numeric string", "not-a-timestamp"),
+            ("none", None),
+        ]
+
+        for label, submitted_time in cases:
+            with self.subTest(label=label):
+                self.assertFalse(self.form.time_diff(submitted_time, self.interval))

wagtail_honeypot/models.py

@@ -44,7 +44,11 @@ def process_form_submission(self, form):
     @staticmethod
     def time_diff(value, interval):
         now_time = str(time.time()).split(".")[0]
-        diff = abs(int(now_time) - int(value))
+        try:
+            submitted_time = int(value)
+        except (TypeError, ValueError):
+            return False
+        diff = abs(int(now_time) - submitted_time)
         return True if diff > interval else False
 
     class Meta: