diff --git a/packages/account-sdk/src/interface/payment/utils/validation.test.ts b/packages/account-sdk/src/interface/payment/utils/validation.test.ts index 6f5bb576..07b1e524 100644 --- a/packages/account-sdk/src/interface/payment/utils/validation.test.ts +++ b/packages/account-sdk/src/interface/payment/utils/validation.test.ts @@ -13,6 +13,9 @@ describe('validateStringAmount', () => { it('should reject invalid amounts', () => { expect(() => validateStringAmount('0', 6)).toThrow('Invalid amount: must be greater than 0'); + expect(() => validateStringAmount('00.000000', 6)).toThrow( + 'Invalid amount: must be greater than 0' + ); expect(() => validateStringAmount('-10', 6)).toThrow('Invalid amount: must be greater than 0'); expect(() => validateStringAmount('abc', 6)).toThrow('Invalid amount: must be a valid number'); expect(() => validateStringAmount('10.1234567', 6)).toThrow( @@ -20,6 +23,15 @@ describe('validateStringAmount', () => { ); }); + it.each(['1abc', '1foo', '1.2.3', '1e6', '1.', '.1', '.', '', ' 1', '1 ', 'Infinity'])( + 'should reject malformed amount %s', + (amount) => { + expect(() => validateStringAmount(amount, 6)).toThrow( + 'Invalid amount: must be a valid number' + ); + } + ); + it('should reject non-string amounts', () => { expect(() => validateStringAmount(10 as any, 6)).toThrow('Invalid amount: must be a string'); }); diff --git a/packages/account-sdk/src/interface/payment/utils/validation.ts b/packages/account-sdk/src/interface/payment/utils/validation.ts index c6e2ad7f..33033f42 100644 --- a/packages/account-sdk/src/interface/payment/utils/validation.ts +++ b/packages/account-sdk/src/interface/payment/utils/validation.ts @@ -11,13 +11,11 @@ export function validateStringAmount(amount: string, maxDecimals: number): void throw new Error('Invalid amount: must be a string'); } - const numAmount = parseFloat(amount); - - if (isNaN(numAmount)) { + if (!/^-?\d+(?:\.\d+)?$/.test(amount)) { throw new Error('Invalid amount: must be a valid number'); } - if (numAmount <= 0) { + if (amount.startsWith('-') || !/[1-9]/.test(amount)) { throw new Error('Invalid amount: must be greater than 0'); }