[10.x] Improve decimal shape validation

[timacdonald]

The decimal rules checks that a value is numeric and then checks the value against a regex.

The current decimal validation regex is expecting:

[+-]? an optional positive / negative symbol

\d* zero or more digits

. any character, except new lines

\d* zero of more digits

All of the following values would pass this regex:

+
-
123
+123
-123
123@
123.
+123@
-123@
+123.
-123.
123@456
123.456
+123@456
-123@456
+123.456
-123.456

However, we first check that the value is numeric in PHP's eyes, so that reduces the values that get checked against the regex to the following set:

123
+123
-123
123.
+123.
-123.
123.456
+123.456
-123.456

but scientific notation will also pass the is_numeric check. So we add the following to the possible values. You will note, however, that these do not match the regex:

1.2e3
7E-10

When the preg_match happens, it has 0 results in $matches, and the rule interprets this as the number having 0 decimal places.

I believe this is a bug and the decimal rule should in fact check that the string matches the expected pattern, i.e., the decimal rule fails for scientific notation.

[timacdonald]

The "dot" has been escaped here. I believe this was a mistake in the original PR.

The dot allows 1 of any character. I believe it should only be a literal ..

[vlakoff]

Nice, you have fixed the concerns I had in #45356 (comment) and following, which didn't get interest then…

With your code:

• pass: 42 / .42 / 42. – fine
• don't pass: .42 / .42 (leading/trailing spaces) – fine too

I noticed a caveat though: it doesn't make sure there is at least one digit,
so the followings would erroneously pass: . / +. / -. (edit: they are rejected actually, see next comment)

[vlakoff]

Empty strings would also pass the regex.

BUT, there is the validateNumeric before the regex. Thanks to this, . / +. / -. / <empty> get rejected actually.

edit: Same with + and -, which would pass the regex but are rejected by the validateNumeric before.

[vlakoff]

After trying various regex features, I figured out a nice way to validate everything without relying on a validateNumeric before.

Let's make use of branch reset:

if (preg_match('/^[+-]?(?|\d+(\.\d*)?|(\.\d+))$/', $value, $matches) !== 1) {
    return false;
}

$decimals = isset($matches[1]) ? (strlen($matches[1]) - 1) : 0;

• pass: 42 / 42. / 42.3 / .3, with optional + or -
• don't pass: . / + / - / +. / -. / empty string

[vlakoff]

Also, leading/trailing spaces should be supported, for consistency with validateNumeric and validateMultipleOf methods. We simply have to add \s* at begin and end of the regex.