[BUG-25] Prop coercion mangles string data (007 → 7, 1e3 → 1000, 0x10 → 16)

[shroy]

Severity: P2 · Batch: B11 (input validation)

Location

src/utils/props.js:11-17 + src/utils/type-guards.js:33

Failure scenario

card-id="007" → 7, "1e3" → 1000, "0x10" → 16, " 42 " → 42 — zip codes, IDs, versions silently corrupted with no opt-out.

Proposed fix

Restrict numeric coercion to /^-?\d+(\.\d+)?$/; document; optionally support a :string escape hatch.

Verification recipe

Spec: element with card-id="007", card-ver="1e3", card-hex="0x10"; extract props; assert values are the original strings. Expected on unmodified code: numbers 7 / 1000 / 16 → confirmed.

[shroy]

Phase 1 verification: CONFIRMED

Method: runtime repro (vitest + jsdom)

Root cause: coerceValue in src/utils/props.js:11-17 calls Number(value) whenever isNumeric(value) is true, and isNumeric (src/utils/type-guards.js:33) is defined as typeof value === 'string' && value.trim() !== '' && !isNaN(Number(value)). Because Number() accepts leading zeros, scientific notation, hex literals, and whitespace-padded strings, any such attribute value is silently converted to a number — corrupting IDs, zip codes, and version strings with no opt-out.

Standalone repro spec (src/tests/__verify__/issue-36.spec.js) asserting the CORRECT behavior (strings preserved):

import { describe, it, expect } from 'vitest'
import { extractProps } from '../../utils/props.js'
import { coerceValue } from '../../utils/props.js'
import { initConfig } from '../../core/config.js'

// BUG-25 / issue #36: Prop coercion mangles string data.
// Correct/documented behavior: values that are NOT plain decimal integers/floats
// (leading-zero IDs, scientific notation, hex, whitespace-padded) must be
// preserved as their original strings, not silently coerced to Number.
//
// These assertions describe the CORRECT behavior, so they FAIL on the
// unmodified code where coerceValue calls Number() on anything isNumeric().

describe('issue-36: prop coercion must not corrupt string data', () => {
  it('preserves leading-zero IDs, scientific notation, hex, and padded values as strings', () => {
    initConfig()

    const element = document.createElement('div')
    element.setAttribute('card-id', '007')   // zip/id with leading zero
    element.setAttribute('card-ver', '1e3')  // version-like / scientific notation
    element.setAttribute('card-hex', '0x10') // hex literal
    element.setAttribute('card-zip', ' 42 ') // whitespace-padded

    const props = extractProps(element, 'Card')

    // Original string data must survive round-trip through prop extraction.
    expect(props.id).toBe('007')
    expect(props.ver).toBe('1e3')
    expect(props.hex).toBe('0x10')
    expect(props.zip).toBe(' 42 ')
  })

  it('coerceValue leaves non-decimal-integer strings untouched', () => {
    expect(coerceValue('007')).toBe('007')
    expect(coerceValue('1e3')).toBe('1e3')
    expect(coerceValue('0x10')).toBe('0x10')
    expect(coerceValue(' 42 ')).toBe(' 42 ')
  })
})

Decisive test output (unmodified code):

 ❯ src/tests/__verify__/issue-36.spec.js  (2 tests | 2 failed) 10ms
   ❯ ... > preserves leading-zero IDs, scientific notation, hex, and padded values as strings
     → expected 7 to be '007' // Object.is equality
   ❯ ... > coerceValue leaves non-decimal-integer strings untouched
     → expected 7 to be '007' // Object.is equality

AssertionError: expected 7 to be '007' // Object.is equality
- Expected:  "007"
+ Received:  7
     27|     expect(props.id).toBe('007')

 Test Files  1 failed (1)
      Tests  2 failed (2)

Interpretation: Confirmed. On the unmodified code, card-id="007" extracts to the number 7 (and likewise "1e3" → 1000, "0x10" → 16, " 42 " → 42), exactly as predicted — string data is silently mangled with no escape hatch. The proposed fix (restricting numeric coercion to /^-?\d+(\.\d+)?$/) would make this spec pass and doubles as a regression test.