This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-lang.git
The following commit(s) were added to refs/heads/master by this push:
new 4bfbfeabe Reject leading whitespace in NumberUtils.createNumber (#1833)
4bfbfeabe is described below
commit 4bfbfeabe548f8e3aa4cc928b51f71939e6eb773
Author: alhuda <[email protected]>
AuthorDate: Sat Oct 24 17:34:15 2026 +0530
Reject leading whitespace in NumberUtils.createNumber (#1833)
createNumber documents that it does not trim its input and that a
string with leading or trailing spaces throws NumberFormatException.
The integral paths honour this through Integer.decode, Long.decode and
BigInteger, but input with a decimal point, an exponent or an f/F/d/D
suffix is handed to Float.valueOf and Double.valueOf, which strip
leading characters up to U+0020 as if by String.trim(). So
createNumber(" 1.5") returned 1.5 and isCreatable(" 1.5d") returned
true while createNumber(" 1111") threw as documented.
Reject a leading character at or below U+0020 before any delegate is
reached, so the decimal paths match the integral paths and the Javadoc.
Trailing whitespace already fails through the type suffix check.
---
src/main/java/org/apache/commons/lang3/math/NumberUtils.java | 4 ++++
.../java/org/apache/commons/lang3/math/NumberUtilsTest.java | 11 +++++++++++
2 files changed, 15 insertions(+)
diff --git a/src/main/java/org/apache/commons/lang3/math/NumberUtils.java
b/src/main/java/org/apache/commons/lang3/math/NumberUtils.java
index c2a1673a1..1e9fc9d99 100644
--- a/src/main/java/org/apache/commons/lang3/math/NumberUtils.java
+++ b/src/main/java/org/apache/commons/lang3/math/NumberUtils.java
@@ -359,6 +359,10 @@ public static Number createNumber(final String str) {
if (StringUtils.isBlank(str)) {
throw new NumberFormatException("A blank string is not a valid
number");
}
+ // Float.valueOf(String) and Double.valueOf(String) trim leading
characters up to U+0020, the integral parsers do not.
+ if (str.charAt(0) <= ' ') {
+ throw new NumberFormatException(str + " is not a valid number.");
+ }
// Need to deal with all possible hex prefixes here
final String[] hexPrefixes = { "0x", "0X", "#" };
final int length = str.length();
diff --git a/src/test/java/org/apache/commons/lang3/math/NumberUtilsTest.java
b/src/test/java/org/apache/commons/lang3/math/NumberUtilsTest.java
index 5e1ea8358..3c36b3c7c 100644
--- a/src/test/java/org/apache/commons/lang3/math/NumberUtilsTest.java
+++ b/src/test/java/org/apache/commons/lang3/math/NumberUtilsTest.java
@@ -917,6 +917,15 @@ void testIsCreatable() {
compareIsCreatableWithCreateNumber("11 11", false);
compareIsCreatableWithCreateNumber(" 1111", false);
compareIsCreatableWithCreateNumber("1111 ", false);
+ compareIsCreatableWithCreateNumber(" 1.5", false);
+ compareIsCreatableWithCreateNumber("\t1.5", false);
+ compareIsCreatableWithCreateNumber(" .5", false);
+ compareIsCreatableWithCreateNumber(" 1e5", false);
+ compareIsCreatableWithCreateNumber(" 1.5f", false);
+ compareIsCreatableWithCreateNumber(" 1.5d", false);
+ compareIsCreatableWithCreateNumber(" 1.5E3D", false);
+ compareIsCreatableWithCreateNumber("1.5 ", false);
+ compareIsCreatableWithCreateNumber("1.5f ", false);
compareIsCreatableWithCreateNumber("2.", true); // LANG-521
compareIsCreatableWithCreateNumber("1.1L", false); // LANG-664
compareIsCreatableWithCreateNumber("+0xF", true); // LANG-1645
@@ -1017,6 +1026,8 @@ void testIsNumber() {
compareIsNumberWithCreateNumber("11 11", false);
compareIsNumberWithCreateNumber(" 1111", false);
compareIsNumberWithCreateNumber("1111 ", false);
+ compareIsNumberWithCreateNumber(" 1.5", false);
+ compareIsNumberWithCreateNumber(" 1.5d", false);
compareIsNumberWithCreateNumber("2.", true); // LANG-521
compareIsNumberWithCreateNumber("1.1L", false); // LANG-664
compareIsNumberWithCreateNumber("+0xF", true); // LANG-1645
