Skip to content

Require ASCII digits in Finnish, French and Indian identifiers - #532

Merged
nandgator merged 1 commit into
masterfrom
fix-ascii-digits-in-identifiers
Oct 22, 2026
Merged

nandgator merged 1 commit into
masterfrom
fix-ascii-digits-in-identifiers

Conversation

@nandgator

Copy link
Copy Markdown
Collaborator

fi_ssn(), fr_ssn(), ind_aadhar() and ind_pan() match their digits with \d, and fr_ssn() and ind_aadhar() their separators with \s. For str patterns these match any Unicode decimal digit and any Unicode whitespace (Python re docs). The checksums then run on int(), which accepts the same digits (docs). So an identifier with one digit or space swapped for a lookalike still validates:

>>> validators.fi_ssn("1٣1052-308T")          # Arabic-Indic three
True
>>> validators.fr_ssn("1 84 12 76 451 089 46")  # no-break space
True
>>> validators.ind_aadhar("3675 9834 6012")    # fullwidth two
True
>>> validators.ind_pan("ABCDE٩999K")           # Arabic-Indic nine
True

This is the same issue #519 fixed for Spanish identifiers. I found these by taking every validator's documented valid example, replacing one ASCII digit at a time with its Arabic-Indic or fullwidth form, and checking which validators still accept the result. card_number(), its brand validators, uuid() and cron() show up as well; #508 covers those.

Change

Add re.ASCII to the four patterns, so \d matches only [0-9] and \s only [ \t\n\r\f\v].

Tests

Each new case is a valid identifier with exactly one character replaced, so the tests isolate the non-ASCII character. All 11 fail on master and pass here. The full suite (1529 tests), doctests, ruff check, ruff format and pyright pass. A fuzz comparison against master (20,000 mutations per validator) found nothing newly accepted, and every newly rejected input contains a non-ASCII character.

fi_ssn(), fr_ssn(), ind_aadhar() and ind_pan() matched digits with \d
and separators with \s, which for str patterns match any Unicode
decimal digit or whitespace, and the checksums use int(), which accepts
the same digits. An identifier with one digit swapped for its
Arabic-Indic or fullwidth form, or a space for a no-break space, still
validated.

Add re.ASCII to the four patterns.
@nandgator
nandgator merged commit f6b27f2 into master Oct 22, 2026
6 checks passed
@nandgator
nandgator deleted the fix-ascii-digits-in-identifiers branch October 22, 2026 02:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant