From e5623d6fdbd6104a7076053ace51eff2443e8ef3 Mon Sep 17 00:00:00 2001
From: yu2971512385-ui <287936273+yu2971512385-ui@users.noreply.github.com>
Date: Thu, 17 Sep 2026 10:14:26 +0800
Subject: [PATCH] fix(isFloat): throw on invalid locale instead of an
 "undefined" separator

When `options.locale` was not a key of the `decimal` separator map, isFloat
interpolated the resulting `undefined` directly into its RegExp, compiling an
8-character `undefined` decimal separator. Unknown locales then silently
accepted strings like "3undefined5" while rejecting ordinary decimals such as
"3.5", with no error and no fallback.

Validate the locale up front and throw `Invalid locale '<locale>'`, matching
isDecimal and the other locale-aware validators.

Fixes #2862

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/lib/isFloat.js      |  3 +++
 test/validators.test.js | 12 ++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/lib/isFloat.js b/src/lib/isFloat.js
index 84bdc782c..9fe2d602b 100644
--- a/src/lib/isFloat.js
+++ b/src/lib/isFloat.js
@@ -5,6 +5,9 @@ import { decimal } from './alpha';
 export default function isFloat(str, options) {
   assertString(str);
   options = options || {};
+  if (options.locale && !(options.locale in decimal)) {
+    throw new Error(`Invalid locale '${options.locale}'`);
+  }
   const float = new RegExp(`^(?:[-+])?(?:[0-9]+)?(?:\\${options.locale ? decimal[options.locale] : '.'}[0-9]*)?(?:[eE][\\+\\-]?(?:[0-9]+))?$`);
   if (str === '' || str === '.' || str === ',' || str === '-' || str === '+') {
     return false;
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..4b20acbbc 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -4940,6 +4940,18 @@ describe('Validators', () => {
     });
   });
 
+  it('should error on invalid locale', () => {
+    test({
+      validator: 'isFloat',
+      args: [{ locale: 'is-NOT' }],
+      error: [
+        '123',
+        '3.5',
+        '3undefined5',
+      ],
+    });
+  });
+
   it('should validate hexadecimal strings', () => {
     test({
       validator: 'isHexadecimal',