fix: reject unquoted numeric JSON amounts to prevent silent rounding - #727
Merged
jahrulezfrancis merged 1 commit intoJul 31, 2026
Merged
Conversation
JSON.parse() applies IEEE-754 rounding before validation, silently altering payment values like 99999999999.9999999 → 100000000000. The parseJSON() function now explicitly rejects numeric amount values with a row-level error directing users to quote amounts as strings. Fixes Batch-Pay#714
|
@wseng is attempting to deploy a commit to the indexhtml's projects Team on Vercel. A member of the Team first needs to authorize it. |
Collaborator
|
@alade-dev Provide a more detailed description for your PR, it helps with backlogs. |
Author
|
Done |
jahrulezfrancis
self-requested a review
July 31, 2026 11:21
jahrulezfrancis
approved these changes
Jul 31, 2026
jahrulezfrancis
left a comment
jahrulezfrancis
left a comment
Collaborator
There was a problem hiding this comment.
@alade-dev Looks good to me. Thanks for your contributions
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When users submit JSON payment instructions with unquoted numeric amounts (e.g., 99999999999.9999999 instead of "99999999999.9999999"), JSON.parse() applies IEEE-754 floating-point rounding before validation occurs. This silently alters critical payment values — for example, 99999999999.9999999 becomes 100000000000 and 0.0000001 can become 1e-7. This can lead to incorrect payment amounts being processed without any error.
Issue: #714
Solution
The parseJSON() function now explicitly checks the type of each amount field after parsing. If item.amount is a number (unquoted), the parser throws a descriptive row-level error instructing the user to quote the amount as a string, e.g.:
Row 1: amount must be a quoted string, not a number (received 99999999999.9999999)
This prevents silent data corruption by failing fast at the input validation stage.
Changes
Backward Compatibility
This is a breaking change for malformed inputs only — any JSON that previously worked with unquoted numeric amounts will now fail with an explicit error. All correctly-formatted JSON (amounts as quoted strings) is unaffected.
Closes #714