From 9a24616c1f38dbf528a852f93b972fe8276ee70a Mon Sep 17 00:00:00 2001 From: jichao wang Date: Sat, 27 Jun 2026 17:56:47 +0100 Subject: [PATCH] Fix UK_NINO regex matching numeric suffix character The suffix capture group was written as `([a-dA-D{1}])`, placing the intended `{1}` quantifier *inside* the character class. Inside a class, `{`, `1`, and `}` are treated as literal members, so the class admitted the digit `1` as a valid NINO suffix (the `{`/`}` variants are only blocked incidentally by the trailing `\b`). A UK National Insurance Number always ends in a single suffix letter A, B, C or D (HMRC/DWP format); a numeric suffix is never valid. As a result inputs such as `AB 12 34 56 1` were wrongly reported as a UK_NINO. The prefix groups in the same pattern already use the correct `[...]{1}` form (quantifier outside the class). Fix by moving the quantifier outside the class: `([a-dA-D]{1})`. Adds parametrized cases asserting a numeric suffix is rejected. --- .../country_specific/uk/uk_nino_recognizer.py | 2 +- presidio-analyzer/tests/test_uk_nino_recognizer.py | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/presidio-analyzer/presidio_analyzer/predefined_recognizers/country_specific/uk/uk_nino_recognizer.py b/presidio-analyzer/presidio_analyzer/predefined_recognizers/country_specific/uk/uk_nino_recognizer.py index 98ad202215..9ced6a505f 100644 --- a/presidio-analyzer/presidio_analyzer/predefined_recognizers/country_specific/uk/uk_nino_recognizer.py +++ b/presidio-analyzer/presidio_analyzer/predefined_recognizers/country_specific/uk/uk_nino_recognizer.py @@ -18,7 +18,7 @@ class UkNinoRecognizer(PatternRecognizer): PATTERNS = [ Pattern( "NINO (medium)", - r"\b(?!bg|gb|nk|kn|nt|tn|zz|BG|GB|NK|KN|NT|TN|ZZ) ?([a-ceghj-pr-tw-zA-CEGHJ-PR-TW-Z]{1}[a-ceghj-npr-tw-zA-CEGHJ-NPR-TW-Z]{1}) ?([0-9]{2}) ?([0-9]{2}) ?([0-9]{2}) ?([a-dA-D{1}])\b", # noqa: E501 + r"\b(?!bg|gb|nk|kn|nt|tn|zz|BG|GB|NK|KN|NT|TN|ZZ) ?([a-ceghj-pr-tw-zA-CEGHJ-PR-TW-Z]{1}[a-ceghj-npr-tw-zA-CEGHJ-NPR-TW-Z]{1}) ?([0-9]{2}) ?([0-9]{2}) ?([0-9]{2}) ?([a-dA-D]{1})\b", # noqa: E501 0.5, ), ] diff --git a/presidio-analyzer/tests/test_uk_nino_recognizer.py b/presidio-analyzer/tests/test_uk_nino_recognizer.py index 8499fb808c..0b2eac7d31 100644 --- a/presidio-analyzer/tests/test_uk_nino_recognizer.py +++ b/presidio-analyzer/tests/test_uk_nino_recognizer.py @@ -26,6 +26,9 @@ def entities(): ("Here is my National Insurance Number YZ 61 48 68 B", 1, ((36, 50),), ((0.5, 0.5),), ), # Invalid National Insurance Numbers ("AA 12 34 56 H", 0, (), (), ), + # The suffix must be a letter A-D; a numeric suffix is never valid. + ("AB 12 34 56 1", 0, (), (), ), + ("ab1234561", 0, (), (), ), ("FQ 00 00 00 C", 0, (), (), ), ("BG123612A", 0, (), (), ), ("nino: nt 99 88 77 a", 0, (), (), ),