From 601ce6c2d65c0b47509c377801812f0764ac46e6 Mon Sep 17 00:00:00 2001
From: Triskell Studio <contact@triskell-studio.fr>
Date: Wed, 24 Jun 2026 00:00:29 +0200
Subject: [PATCH] fix(isLicensePlate): anchor pt-BR alternation to reject
 partial strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'pt-BR' pattern placed an un-grouped alternation between the ^ and $
anchors:

  /^[A-Z]{3}[ -]?[0-9][A-Z][0-9]{2}|[A-Z]{3}[ -]?[0-9]{4}$/

Because | has lower precedence than the anchors, the engine reads this
as two half-anchored branches — ^A (start-anchored only) and B$
(end-anchored only). The validator therefore accepted any string that
merely starts with a Mercosur plate or ends with an old-format plate.
For example isLicensePlate('ABC1D23XYZ', 'pt-BR') and
isLicensePlate('fooABC1234', 'pt-BR') both returned true.

Wrapping the alternation in a non-capturing group makes both anchors
apply to every branch. All previously valid plates still pass; the added
tests cover leading/trailing-junk inputs that were wrongly accepted.
---
 src/lib/isLicensePlate.js | 2 +-
 test/validators.test.js   | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/lib/isLicensePlate.js b/src/lib/isLicensePlate.js
index 54d80635f..b41eb845c 100644
--- a/src/lib/isLicensePlate.js
+++ b/src/lib/isLicensePlate.js
@@ -12,7 +12,7 @@ const validators = {
   'fi-FI': str => /^(?=.{4,7})(([A-Z]{1,3}|[0-9]{1,3})[\s-]?([A-Z]{1,3}|[0-9]{1,5}))$/.test(str),
   'hu-HU': str => /^((((?!AAA)(([A-NPRSTVZWXY]{1})([A-PR-Z]{1})([A-HJ-NPR-Z]))|(A[ABC]I)|A[ABC]O|A[A-W]Q|BPI|BPO|UCO|UDO|XAO)-(?!000)\d{3})|(M\d{6})|((CK|DT|CD|HC|H[ABEFIKLMNPRSTVX]|MA|OT|R[A-Z]) \d{2}-\d{2})|(CD \d{3}-\d{3})|(C-(C|X) \d{4})|(X-(A|B|C) \d{4})|(([EPVZ]-\d{5}))|(S A[A-Z]{2} \d{2})|(SP \d{2}-\d{2}))$/.test(str),
   'pt-BR': str =>
-    /^[A-Z]{3}[ -]?[0-9][A-Z][0-9]{2}|[A-Z]{3}[ -]?[0-9]{4}$/.test(str),
+    /^(?:[A-Z]{3}[ -]?[0-9][A-Z][0-9]{2}|[A-Z]{3}[ -]?[0-9]{4})$/.test(str),
   'pt-PT': str =>
     /^(([A-Z]{2}[ -·]?[0-9]{2}[ -·]?[0-9]{2})|([0-9]{2}[ -·]?[A-Z]{2}[ -·]?[0-9]{2})|([0-9]{2}[ -·]?[0-9]{2}[ -·]?[A-Z]{2})|([A-Z]{2}[ -·]?[0-9]{2}[ -·]?[A-Z]{2}))$/.test(str),
   'sq-AL': str =>
diff --git a/test/validators.test.js b/test/validators.test.js
index 7d9d12690..f976f17d9 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -14972,6 +14972,10 @@ describe('Validators', () => {
         'ABCD123',
         'AB12345',
         'AB123DC',
+        'ABC1D23XYZ',
+        'ABC1D2345',
+        'XYZABC1234',
+        'fooABC1234',
       ],
     });
     test({