sahvx655-wq opened a new pull request, #435:
URL: https://github.com/apache/commons-validator/pull/435
`SedolCheckDigit.SEDOL_CHECK_DIGIT.isValid` is a public `CheckDigit` entry
point with no wrapping validator, yet its `calculateModulus` override only
rejects codes longer than the seven-character weight table. A shorter string
whose weighted digits happen to sum to a multiple of ten therefore validates:
`isValid("55")`, `isValid("550")`, `isValid("5500")` and `isValid("0055")` all
return true, though a SEDOL is defined as exactly seven characters. I traced it
back from the weight loop after noticing the base-class `isValid` does no
length check of its own, so this one-sided `>` comparison is the only thing
standing between a short input and a false positive.
The guard now also requires the validated form (the code passed with its
check digit) to be exactly seven characters, while the calculate path still
receives the six-character base and so keeps only the over-length check.
Holding the length rule inside `calculateModulus`, next to the weight table it
depends on, keeps the validate and calculate callers consistent without either
repeating it. Left as it was, a caller relying on `SEDOL_CHECK_DIGIT` to screen
out malformed identifiers would accept a two-character string as a valid
security identifier.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
