[PM-39358] fix: Reject partial card scans via Luhn and brand-length validation#2845
Open
fedemkr wants to merge 1 commit into
Open
[PM-39358] fix: Reject partial card scans via Luhn and brand-length validation#2845fedemkr wants to merge 1 commit into
fedemkr wants to merge 1 commit into
Conversation
…alidation Partial OCR scans could produce digit sequences that matched the card-number regex and were auto-filled despite being incomplete. CardTextParser now rejects any candidate number that fails the Luhn mod-10 checksum or whose digit count does not match the expected length for the detected brand.
github-actions
Bot
added
app:password-manager
Contributor
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE Reviewed the addition of Luhn mod-10 checksum and brand-specific digit-length validation to Code Review DetailsNo findings. Notable correctness checks that passed:
|
Comment on lines
+172
to
+189
| /// Returns `true` if `digits` satisfies the Luhn mod-10 checksum. | ||
| private func isLuhnValid(_ digits: String) -> Bool { | ||
| var sum = 0 | ||
| for (index, char) in digits.reversed().enumerated() { | ||
| guard var digit = char.wholeNumberValue else { return false } | ||
| if !index.isMultiple(of: 2) { | ||
| digit *= 2 | ||
| if digit > 9 { digit -= 9 } | ||
| } | ||
| sum += digit | ||
| } | ||
| return sum.isMultiple(of: 10) | ||
| } | ||
|
|
||
| /// Returns `true` if `digits` has a length valid for the brand detected from its leading digits. | ||
| private func hasValidLength(_ digits: String) -> Bool { | ||
| CardComponent.Brand.detect(from: digits).validDigitLengths.contains(digits.count) | ||
| } |
Collaborator
There was a problem hiding this comment.
⛏️ Can you alphabetize these?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎟️ Tracking
https://bitwarden.atlassian.net/browse/PM-39358
📔 Objective
Partial OCR card scans could produce digit sequences that matched the regex in
CardTextParserand were auto-filled into the card-number field despite being incomplete (e.g. the card was not fully in frame). This PR adds two validation layers insideCardTextParser.extractCardNumber(from:):CardComponent.Brandis extended with avalidDigitLengths: Set<Int>property that drives the length check.No UI changes; scanner behaviour is unchanged from the user's perspective — the form simply never populates from an invalid number.