Skip to content

Fix electronicFormatIBAN() mapping non-ASCII characters into A-Z - #691

Open
kinu01 wants to merge 1 commit into
Simplify:masterfrom
kinu01:fix/electronic-format-ascii-uppercase
Open

Fix electronicFormatIBAN() mapping non-ASCII characters into A-Z#691
kinu01 wants to merge 1 commit into
Simplify:masterfrom
kinu01:fix/electronic-format-ascii-uppercase

Conversation

@kinu01

@kinu01 kinu01 commented Aug 26, 2026

Copy link
Copy Markdown

Fixes #690.

electronicFormatIBAN() called String.prototype.toUpperCase(), which applies full Unicode case mapping. Characters like U+FB01 (fi), U+00DF (ß) and U+0131 (ı) map into A-Z, sometimes expanding one character into two. Since isValidIBAN() does not normalise its own input, those strings were validated as real IBANs.

This changes the uppercasing to ASCII only, so any character outside the ISO 13616 set survives normalisation and is rejected by the country's BBAN pattern.

  • src/ibantools.ts: ASCII-only uppercase, with a comment explaining why the built-in cannot be used here.
  • test/ibantools_test.js: 8 regression tests. All 8 fail on master and pass with the fix. Also adds a lowercase input test for electronicFormatIBAN(), since the existing Brazilian test has no lowercase letters and so did not cover the new callback.
  • ChangeLog: entry added.

No behaviour change for valid input. Both README examples, lowercase input and spaced or dashed input all still normalise exactly as before.

npm run all passes: 270 tests, lint clean, docs build. Coverage on build/ibantools.js is unchanged at 99.76% statements and 100% functions (branch coverage goes from 90.74% to 90.78%).

I left dist, jsnext and docs out of the diff as CONTRIBUTING asks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

electronicFormatIBAN() maps non-ASCII characters into A-Z, so isValidIBAN() accepts strings that are not IBANs

1 participant