fix(isNumeric): reject unknown decimal locales

README.md

@@ -153,7 +153,7 @@ Validator                               | Description
 **isMobilePhone(str [, locale [, options]])**          | check if the string is a mobile phone number,<br/><br/>`locale` is either an array of locales (e.g. `['sk-SK', 'sr-RS']`) OR one of `['am-AM', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-LB', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LY', 'ar-MA', 'ar-OM', 'ar-PS', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'az-AZ', 'ar-QA', 'bs-BA', 'be-BY', 'bg-BG', 'bn-BD', 'ca-AD', 'cs-CZ', 'da-DK', 'de-DE', 'de-AT', 'de-CH', 'de-LU', 'dv-MV', 'el-GR', 'el-CY', 'en-AI', 'en-AU', 'en-AG', 'en-BM', 'en-BS', 'en-GB', 'en-GG', 'en-GH', 'en-GY', 'en-HK', 'en-MO', 'en-IE', 'en-IN', 'en-JM', 'en-KE', 'fr-CF', 'en-SS', 'en-KI', 'en-KN', 'en-LS', 'en-MT', 'en-MU', 'en-MW', 'en-NA', 'en-NG', 'en-NZ', 'en-PG', 'en-PK', 'en-PH', 'en-RW', 'en-SG', 'en-SL', 'en-TZ', 'en-UG', 'en-US', 'en-ZA', 'en-ZM', 'en-ZW', 'en-BW', 'es-AR', 'es-BO', 'es-CO', 'es-CL', 'es-CR', 'es-CU', 'es-DO', 'es-HN', 'es-EC', 'es-ES', 'es-GT', 'es-PE', 'es-MX', 'es-NI', 'es-PA', 'es-PY', 'es-SV', 'es-UY', 'es-VE', 'et-EE', 'fa-IR', 'fi-FI', 'fj-FJ', 'fo-FO', 'fr-BF', 'fr-BJ', 'fr-CD', 'fr-CM', 'fr-DJ', 'fr-FR', 'fr-GF', 'fr-GP', 'fr-MQ', 'fr-PF', 'fr-RE', 'fr-WF', 'he-IL', 'hu-HU', 'id-ID', 'ir-IR', 'it-IT', 'it-SM', 'ja-JP', 'ka-GE', 'kk-KZ', 'kl-GL', 'ko-KR', 'ky-KG', 'lt-LT', 'lv-LV', 'mg-MG', 'mn-MN', 'my-MM', 'ms-MY', 'mz-MZ', 'nb-NO', 'ne-NP', 'nl-BE', 'nl-NL', 'nl-AW', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'pt-AO', 'ro-MD', 'ro-RO', 'ru-RU', 'si-LK', 'sl-SI', 'sk-SK', 'so-SO', 'sq-AL', 'sr-RS', 'sv-SE', 'tg-TJ', 'th-TH', 'tr-TR', 'tk-TM', 'uk-UA', 'uz-UZ', 'vi-VN', 'zh-CN', 'zh-TW', 'dz-BT', 'ar-YE', 'ar-EH', 'fa-AF', 'mk-MK', 'en-CA', 'fr-CA', 'fr-BE', 'zh-HK', 'zh-MO', 'ga-IE', 'fr-CH', 'it-CH', 'en-CM']` OR defaults to `'any'`. If `any` or a falsey value is used, the function will check if any of the locales match.<br/><br/>`options` is an optional object that can be supplied with the following key: `strictMode`. If this is set to `true`, the mobile phone number must be supplied with the country code and therefore must start with `+`. Locale list is `validator.isMobilePhoneLocales`.
 **isMongoId(str)**                      | check if the string is a valid hex-encoded representation of a [MongoDB ObjectId][mongoid].
 **isMultibyte(str)**                    | check if the string contains one or more multibyte chars.
-**isNumeric(str [, options])**                      | check if the string contains only numbers.<br/><br/>`options` is an object which defaults to `{ no_symbols: false }` it also has `locale` as an option. If `no_symbols` is true, the validator will reject numeric strings that feature a symbol (e.g. `+`, `-`, or `.`).<br/><br/>`locale` determines the decimal separator and is one of `['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'bg-BG', 'cs-CZ', 'da-DK', 'de-DE', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'eo', 'es-ES', 'fr-FR', 'fr-CA', 'hu-HU', 'it-IT', 'nb-NO', 'nl-NL', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'sl-SI', 'sr-RS', 'sr-RS@latin', 'sv-SE', 'tr-TR', 'uk-UA']`.
+**isNumeric(str [, options])**                      | check if the string contains only numbers.<br/><br/>`options` is an object which defaults to `{ no_symbols: false }` it also has `locale` as an option. If `no_symbols` is true, the validator will reject numeric strings that feature a symbol (e.g. `+`, `-`, or `.`).<br/><br/>`locale` determines the decimal separator and is one of `['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'bg-BG', 'cs-CZ', 'da-DK', 'de-DE', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'eo', 'es-ES', 'fr-FR', 'fr-CA', 'hu-HU', 'it-IT', 'nb-NO', 'nl-NL', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'sl-SI', 'sr-RS', 'sr-RS@latin', 'sv-SE', 'tr-TR', 'uk-UA']`. An unrecognized, non-empty `locale` throws an error, unless `no_symbols` is `true`.
 **isOctal(str)**                        | check if the string is a valid octal number.
 **isPassportNumber(str, countryCode)**    | check if the string is a valid passport number.<br/><br/>`countryCode` is one of `['AM', 'AR', 'AT', 'AU', 'AZ', 'BE', 'BG', 'BY', 'BR', 'CA', 'CH', 'CN', 'CY', 'CZ', 'DE', 'DK', 'DZ', 'EE', 'ES', 'FI', 'FR', 'GB', 'GR', 'HR', 'HU', 'IE', 'IN', 'IR', 'ID', 'IS', 'IT', 'JM', 'JP', 'KR', 'KZ', 'LI', 'LT', 'LU', 'LV', 'LY', 'MT', 'MX', 'MY', 'MZ', 'NL', 'NZ', 'PH', 'PK', 'PL', 'PT', 'RO', 'RU', 'SE', 'SL', 'SK', 'TH', 'TR', 'UA', 'US', 'ZA']`.  Locale list is `validator.passportNumberLocales`.
 **isPort(str)**                         | check if the string is a valid port number.

src/lib/isNumeric.js

@@ -8,5 +8,8 @@ export default function isNumeric(str, options) {
   if (options && options.no_symbols) {
     return numericNoSymbols.test(str);
   }
+  if (options && options.locale && !Object.prototype.hasOwnProperty.call(decimal, options.locale)) {
+    throw new Error(`Invalid locale '${options.locale}'`);
+  }
   return (new RegExp(`^[+-]?([0-9]*[${(options || {}).locale ? decimal[options.locale] : '.'}])?[0-9]+$`)).test(str);
 }

test/validators.test.js

@@ -3210,6 +3210,25 @@ describe('Validators', () => {
     });
   });
 
+  it('should error on invalid numeric locales', () => {
+    ['de-CH', 'toString', 'constructor', '__proto__'].forEach((locale) => {
+      test({
+        validator: 'isNumeric',
+        args: [{ locale }],
+        error: ['n1', '12d34', '123', '3.5'],
+      });
+    });
+  });
+
+  it('should ignore the numeric locale when symbols are disabled', () => {
+    test({
+      validator: 'isNumeric',
+      args: [{ locale: 'de-CH', no_symbols: true }],
+      valid: ['123'],
+      invalid: ['n1', '12d34', '3.5'],
+    });
+  });
+
   it('should validate ports', () => {
     test({
       validator: 'isPort',