From 1cab94be29992a9b11e53fd55ba559941bd02283 Mon Sep 17 00:00:00 2001 From: aiirvizionz Date: Sat, 25 Jul 2026 16:20:16 -0600 Subject: [PATCH] fix(sponsor): reject non-numeric amount types --- apps/web/lib/sponsor-amount.test.ts | 15 +++++++++++++++ apps/web/lib/sponsor-amount.ts | 3 +++ 2 files changed, 18 insertions(+) diff --git a/apps/web/lib/sponsor-amount.test.ts b/apps/web/lib/sponsor-amount.test.ts index 7866f78..5a3f9a1 100644 --- a/apps/web/lib/sponsor-amount.test.ts +++ b/apps/web/lib/sponsor-amount.test.ts @@ -34,4 +34,19 @@ describe("normalizeSponsorAmountUsd", () => { error: "Enter a valid sponsorship amount.", }); }); + + it("rejects non-string and non-number values before numeric coercion", () => { + expect(normalizeSponsorAmountUsd([5])).toEqual({ + ok: false, + error: "Enter a valid sponsorship amount.", + }); + expect(normalizeSponsorAmountUsd({ valueOf: () => 5 })).toEqual({ + ok: false, + error: "Enter a valid sponsorship amount.", + }); + expect(normalizeSponsorAmountUsd(true)).toEqual({ + ok: false, + error: "Enter a valid sponsorship amount.", + }); + }); }); diff --git a/apps/web/lib/sponsor-amount.ts b/apps/web/lib/sponsor-amount.ts index 72e6c4a..45f1a83 100644 --- a/apps/web/lib/sponsor-amount.ts +++ b/apps/web/lib/sponsor-amount.ts @@ -6,6 +6,9 @@ export function normalizeSponsorAmountUsd( if (typeof value === "string" && !/^\d+(?:\.\d+)?$/.test(value.trim())) { return { ok: false, error: "Enter a valid sponsorship amount." }; } + if (typeof value !== "string" && typeof value !== "number") { + return { ok: false, error: "Enter a valid sponsorship amount." }; + } const amount = Math.round(Number(value) * 100) / 100; if (!Number.isFinite(amount)) {