Skip to content

fix(isRgbColor): don't strip whitespace inside values when allowSpaces is true - #2891

Open
yu2971512385-ui wants to merge 1 commit into
validatorjs:masterfrom
yu2971512385-ui:fix/isRgbColor-inner-whitespace
Open

yu2971512385-ui wants to merge 1 commit into
validatorjs:masterfrom
yu2971512385-ui:fix/isRgbColor-inner-whitespace

Conversation

@yu2971512385-ui

Copy link
Copy Markdown

Fixes #2885.

The bug

With { allowSpaces: true }, isRgbColor strips every whitespace character before testing the numeric patterns:

str = str.replace(/\s/g, '');

That also removes whitespace that falls inside a token, so malformed values are silently accepted:

validator.isRgbColor('rgb(2 55,0,0)',   { allowSpaces: true }); // true → '2 55' becomes '255'
validator.isRgbColor('rgba(0,0,0,0. 5)', { allowSpaces: true }); // true → '0. 5' becomes '0.5'
validator.isRgbColor('rgb(25 %,0%,0%)',  { allowSpaces: true }); // true → '25 %' becomes '25%'

The fix

Collapse only the whitespace adjacent to the parentheses and commas instead of all whitespace:

str = str.replace(/\s*([(),])\s*/g, '$1');

Whitespace around the comma-separated values keeps working (rgb( 255 , 0 , 0 ) stays valid), while whitespace inside a channel/alpha/percent token now fails validation as expected. Each channel or alpha value must form a contiguous numeric token and a % must immediately follow its number.

Tests

Extended the existing { includePercentValues: true, allowSpaces: true } case with the three malformed inputs (now invalid) and a spaced-but-valid rgb( 255 , 0 , 0 ). Verified the additions fail on the unpatched source and pass with the fix; full npm test is green.

Checklist

  • PR contains only changes related; no stray files, etc.
  • README updated (where applicable)
  • Tests written (where applicable)
  • References provided in PR (where applicable)

🤖 Generated with Claude Code

Comment thread src/lib/isRgbColor.js Fixed
@codecov

codecov Bot commented Sep 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (9ff3424) to head (f4baeaf).

Additional details and impacted files
@@            Coverage Diff            @@
##            master     #2891   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2599           
  Branches       658       658           
=========================================
  Hits          2599      2599           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…s is true

With `{ allowSpaces: true }` the validator stripped every whitespace character
before testing the numeric patterns, so malformed values whose whitespace fell
*inside* a token were silently accepted: `rgb(2 55,0,0)`, `rgba(0,0,0,0. 5)`
and `rgb(25 %,0%,0%)` all returned true.

Collapse whitespace runs and then drop only the whitespace adjacent to the
parentheses and commas, so whitespace around the comma-separated values (e.g.
`rgb( 255 , 0 , 0 )`) keeps working while whitespace inside a channel/alpha/
percent token now fails validation. The two passes use bounded quantifiers to
avoid polynomial-time backtracking on all-whitespace input.

Fixes validatorjs#2885

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@yu2971512385-ui
yu2971512385-ui force-pushed the fix/isRgbColor-inner-whitespace branch from 5a079c5 to f4baeaf Compare September 17, 2026 03:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

isRgbColor accepts whitespace inside numeric values with allowSpaces: true

2 participants