isISO6346 and isFreightContainerID accept malformed strings

Open Beginner friendly
#2,772 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
86/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
backend

Research direction

Start with the validation regex in src/lib/isISO6346.js and inspect the existing valid and invalid fixtures for ISO6346. Update the validation so the reported malformed examples are rejected, then run the relevant validator tests and confirm all existing fixtures remain correct.

Written by the indexing model from the issue text.

Description

isISO6346 (and its alias isFreightContainerID) accepts strings with arbitrary leading or trailing characters, and accepts a literal comma.

The validation regex in src/lib/isISO6346.js is:

const isISO6346Str = /^[A-Z]{3}(U[0-9]{7})|([J,Z][0-9]{6,7})$/;

The alternation is not grouped, so ^ anchors only the first branch and $ only the second:

  • ^[A-Z]{3}(U[0-9]{7}) matches anything starting with the owner prefix, U and 7 digits, ignoring trailing characters.
  • ([J,Z][0-9]{6,7})$ matches anything ending with J/Z and 6-7 digits, ignoring the leading owner prefix.

[J,Z] is also a character class containing a literal comma. Inputs whose length is not 11 skip the checksum and return true, so malformed strings pass.

Reproduction:

const validator = require('validator');
validator.isISO6346('ABCU1234567HELLO'); // true, expected false
validator.isISO6346('CSQU3054383XXX');   // true, expected false (CSQU3054383 is valid, with trailing junk)
validator.isISO6346('hellozZ123456');    // true, expected false
validator.isISO6346('AB,123456');        // true, expected false (literal comma)

Fix: group the alternation inside the anchors and drop the comma, /^[A-Z]{3}(U[0-9]{7}|[JZ][0-9]{6,7})$/. This keeps every existing valid and invalid fixture correct and rejects the cases above. PR follows.

Dominant language
JavaScript
Stars
23.7k
Forks
2.5k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from validatorjs/validator.js

All issues in validatorjs/validator.js

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.