Skip to content

Fix UK_NINO regex matching a numeric suffix character#2112

Merged
SharonHart merged 2 commits into
data-privacy-stack:mainfrom
jichaowang02-lang:fix/uk-nino-numeric-suffix
Jun 29, 2026
Merged

Fix UK_NINO regex matching a numeric suffix character#2112
SharonHart merged 2 commits into
data-privacy-stack:mainfrom
jichaowang02-lang:fix/uk-nino-numeric-suffix

Conversation

@jichaowang02-lang

Copy link
Copy Markdown
Contributor

Summary

The UK_NINO (UK National Insurance Number) pattern accepts a numeric suffix, producing false positives such as AB 12 34 56 1.

The suffix capture group is written as:

... ?([a-dA-D{1}])\b

The intended quantifier {1} was placed inside the character class. Inside a class, {, 1 and } are literal members, so the class is effectively [a-dA-D{1}] — it admits the digit 1 in addition to the valid suffix letters. ({/} are only blocked incidentally by the trailing \b, but 1 is a word character and is not.)

A NINO always ends in a single suffix letter A, B, C or D (HMRC/DWP format); a numeric suffix is never valid. The two prefix groups in the very same pattern already use the correct form with the quantifier outside the class ([...]{1}).

Fix

Move the quantifier outside the class:

-... ?([a-dA-D{1}])\b
+... ?([a-dA-D]{1})\b

Tests

Added parametrized cases asserting a numeric suffix is rejected (AB 12 34 56 1, ab1234561). All existing test_uk_nino_recognizer.py cases continue to pass (12 passed). ruff check . is clean.

The suffix capture group was written as `([a-dA-D{1}])`, placing the
intended `{1}` quantifier *inside* the character class. Inside a class,
`{`, `1`, and `}` are treated as literal members, so the class admitted
the digit `1` as a valid NINO suffix (the `{`/`}` variants are only
blocked incidentally by the trailing `\b`).

A UK National Insurance Number always ends in a single suffix letter
A, B, C or D (HMRC/DWP format); a numeric suffix is never valid. As a
result inputs such as `AB 12 34 56 1` were wrongly reported as a
UK_NINO. The prefix groups in the same pattern already use the correct
`[...]{1}` form (quantifier outside the class).

Fix by moving the quantifier outside the class: `([a-dA-D]{1})`.
Adds parametrized cases asserting a numeric suffix is rejected.
Copilot AI review requested due to automatic review settings June 27, 2026 16:57

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

@SharonHart SharonHart merged commit 0ff7541 into data-privacy-stack:main Jun 29, 2026
33 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants