Skip to content

fix(isCreditCard): anchor Mastercard regex alternation#2727

Open
xxiaoxiong wants to merge 1 commit into
validatorjs:masterfrom
xxiaoxiong:fix/creditcard-mastercard-regex
Open

fix(isCreditCard): anchor Mastercard regex alternation#2727
xxiaoxiong wants to merge 1 commit into
validatorjs:masterfrom
xxiaoxiong:fix/creditcard-mastercard-regex

Conversation

@xxiaoxiong
Copy link
Copy Markdown

Problem

isCreditCard("5108") returns true because the Mastercard regex:

/^5[1-5][0-9]{2}|(222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$/

has an anchoring bug: | binds weaker than ^ and $, so the regex is parsed as:

  1. ^5[1-5][0-9]{2} — start-anchored only, matches any 4+ digit string starting with 51-55
  2. (...)[0-9]{12}$ — end-anchored only

Fix

Wrapped the alternation in a non-capturing group:

/^(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$/

Also fixed the same issue in the unionpay regex.

Fixes #2717

The Mastercard regex `/^5[1-5][0-9]{2}|(...)[0-9]{12}$/` has an
anchoring bug: `|` binds weaker than `^`/`$`, so `^` only anchors
the first branch (matching any 4-digit string starting with 51-55)
and `$` only anchors the second branch.

Wrapped in `(?:...)` so both anchors apply to all alternatives.
Also fixed the same issue in unionpay regex.

Fixes validatorjs#2717
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

isCreditCard: Mastercard regex anchoring bug accepts 4-digit and partial strings

1 participant