Skip to content

fix(isFloat): throw on invalid locale instead of an "undefined" separator - #2890

Open
yu2971512385-ui wants to merge 1 commit into
validatorjs:masterfrom
yu2971512385-ui:fix/isFloat-invalid-locale
Open

yu2971512385-ui wants to merge 1 commit into
validatorjs:masterfrom
yu2971512385-ui:fix/isFloat-invalid-locale

Conversation

@yu2971512385-ui

Copy link
Copy Markdown

Fixes #2862.

The bug

isFloat interpolates the locale separator straight into a RegExp:

const float = new RegExp(`^(?:[-+])?(?:[0-9]+)?(?:\\${options.locale ? decimal[options.locale] : '.'}[0-9]*)?...`);

When options.locale is not a key of decimal, the lookup yields undefined, which stringifies into the pattern as the literal text undefined (the preceding \ + u degrades to a literal u). The compiled separator becomes the 8‑character string undefined, so an unrecognized locale silently accepts nonsense and rejects ordinary decimals — with no error and no fallback:

validator.isFloat('3undefined5', { locale: 'no-such' }); // true  (should not)
validator.isFloat('3.5',         { locale: 'no-such' }); // false (should not)

The fix

Validate options.locale against decimal up front and throw Invalid locale '<locale>' when it is unknown. This mirrors isDecimal (which shares the same decimal map) and the other locale-aware validators (isAlpha, isAlphanumeric, isMobilePhone, isPostalCode, …), which already throw on an invalid locale. Absent/known locales are unaffected.

Tests

Added an isFloat "should error on invalid locale" case alongside the existing isDecimal one. Verified it fails on the unpatched source and passes with the fix; the full suite (npm test) is green.

Checklist

  • PR contains only changes related; no stray files, etc.
  • README updated (where applicable)
  • Tests written (where applicable)
  • References provided in PR (where applicable)

🤖 Generated with Claude Code

…ator

When `options.locale` was not a key of the `decimal` separator map, isFloat
interpolated the resulting `undefined` directly into its RegExp, compiling an
8-character `undefined` decimal separator. Unknown locales then silently
accepted strings like "3undefined5" while rejecting ordinary decimals such as
"3.5", with no error and no fallback.

Validate the locale up front and throw `Invalid locale '<locale>'`, matching
isDecimal and the other locale-aware validators.

Fixes validatorjs#2862

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@codecov

codecov Bot commented Sep 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (9ff3424) to head (e5623d6).

Additional details and impacted files
@@            Coverage Diff            @@
##            master     #2890   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2601    +2     
  Branches       658       659    +1     
=========================================
+ Hits          2599      2601    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

isFloat builds a literal undefined separator for an unknown locale

1 participant