Skip to content

fix(isFloat): reject bare-exponent strings like "e5" - #2831

Draft
nikolauspschuetz wants to merge 1 commit into
validatorjs:masterfrom
nikolauspschuetz:fix-isfloat-bare-exponent
Draft

fix(isFloat): reject bare-exponent strings like "e5"#2831
nikolauspschuetz wants to merge 1 commit into
validatorjs:masterfrom
nikolauspschuetz:fix-isfloat-bare-exponent

Conversation

@nikolauspschuetz

Copy link
Copy Markdown

Bug

isFloat returns true for strings that are only an exponent, with no mantissa:

isFloat('e5')   // true  ❌  (parseFloat('e5') === NaN)
isFloat('E5')   // true  ❌
isFloat('.e3')  // true  ❌
isFloat('e-3')  // true  ❌
isFloat('+e5')  // true  ❌

The validation regex makes every segment optional — sign, integer part, fraction, and exponent — so a string consisting of just an exponent matches. The function never rejects the NaN that its own parseFloat produces.

The bug only surfaces on the common no-min/max call: when a bound is supplied, NaN >= min is false and the string is (incidentally) rejected.

Fix

Guard the result with !Number.isNaN(value).

value was computed as parseFloat(str.replace(',', '.')) — only the comma separator was normalized. To keep the NaN check correct for locales whose decimal separator is neither . nor , (e.g. ar-JO, which uses ٫), value is now computed with the locale-aware separator. This is a no-op for the default/en/de-DE locales and makes the guard sound across all locales.

Test

Added 'e5', 'E5', '.e3', 'e-3', '+e5' to the invalid list of the default isFloat test.

Verified fails-before / passes-after: with the src change reverted the should validate floats suite fails on the new cases; with the fix the full suite (default, en-AU, de-DE, ar-JO, and the min/max/lt/gt blocks) passes.

isFloat returned true for strings that are only an exponent with no
mantissa ("e5", "E5", ".e3", "e-3", "+e5") because every segment of
the validation regex is optional. parseFloat returns NaN for these, so
the values are not floats.

Guard the result with !Number.isNaN(value). Computing value with a
locale-aware decimal separator (instead of a hardcoded comma) keeps the
NaN check correct for non-'.'/',' locales such as ar-JO.
@codecov

codecov Bot commented Jul 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (b18bde8) to head (0e2554a).

Additional details and impacted files
@@            Coverage Diff            @@
##            master     #2831   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2600      2601    +1     
  Branches       659       659           
=========================================
+ Hits          2600      2601    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant