Skip to content

Reject non-ASCII digits and letters in pt.cc and iso6346 - #527

Open
adityakale2002 wants to merge 1 commit into
arthurdejong:masterfrom
adityakale2002:fix/non-ascii-digits-crash
Open

adityakale2002 wants to merge 1 commit into
arthurdejong:masterfrom
adityakale2002:fix/non-ascii-digits-crash

Conversation

@adityakale2002

Copy link
Copy Markdown

pt.cc and iso6346 build their format check with \d / \w. For str patterns these also match non-ASCII digits and letters, so such values pass the format check and then make validate() / is_valid() raise ValueError (from str.index) instead of a ValidationError.

>>> from stdnum.pt import cc
>>> cc.is_valid('00000000 ٠ ZZ4')   # ARABIC-INDIC DIGIT ZERO
ValueError: substring not found
>>> from stdnum import iso6346
>>> iso6346.is_valid('CSÉU3054383')
ValueError: substring not found

is_valid() should never raise. This switches both patterns to explicit ASCII classes ([0-9], [A-Z] for the three-letter owner code, which ISO 6346 defines as capital letters). Doctests are added to tests/test_pt_cc.doctest and tests/test_iso6346.doctest; they fail before the change and pass after, and the full suite passes.

I found this by fuzzing every module's validate/is_valid/compact with random input. Some other modules (damm, verhoeff, lei, iso11649, eg.tn, iso7064.*) accept non-ASCII digits as valid rather than crashing. I left those out to keep this small, but can follow up if you want them handled.

Written with the help of Claude Code, and I reviewed the change and ran the tests.

🤖 Generated with Claude Code

The regular expressions used \d and \w, which match non-ASCII digits and
letters for str patterns. Values such as '00000000 0 ZZ4' written with
Arabic-Indic digits passed the format check and then made validate() and
is_valid() raise ValueError instead of a ValidationError.

Use explicit ASCII character classes instead.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant