From f4baeaf082fc66d38fb37baba19e7cca2a08035a Mon Sep 17 00:00:00 2001
From: yu2971512385-ui <287936273+yu2971512385-ui@users.noreply.github.com>
Date: Thu, 17 Sep 2026 10:40:41 +0800
Subject: [PATCH] fix(isRgbColor): don't strip whitespace inside values when
 allowSpaces is true

With `{ allowSpaces: true }` the validator stripped every whitespace character
before testing the numeric patterns, so malformed values whose whitespace fell
*inside* a token were silently accepted: `rgb(2 55,0,0)`, `rgba(0,0,0,0. 5)`
and `rgb(25 %,0%,0%)` all returned true.

Collapse whitespace runs and then drop only the whitespace adjacent to the
parentheses and commas, so whitespace around the comma-separated values (e.g.
`rgb( 255 , 0 , 0 )`) keeps working while whitespace inside a channel/alpha/
percent token now fails validation. The two passes use bounded quantifiers to
avoid polynomial-time backtracking on all-whitespace input.

Fixes #2885

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/lib/isRgbColor.js   | 7 +++++--
 test/validators.test.js | 4 ++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/lib/isRgbColor.js b/src/lib/isRgbColor.js
index e9fb60253..eb2a563ef 100644
--- a/src/lib/isRgbColor.js
+++ b/src/lib/isRgbColor.js
@@ -27,8 +27,11 @@ export default function isRgbColor(str, options) {
     if (!startsWithRgb.test(str)) {
       return false;
     }
-    // strip all whitespace
-    str = str.replace(/\s/g, '');
+    // collapse whitespace runs, then drop only the whitespace adjacent to the
+    // parentheses and commas; whitespace inside a channel/alpha/percent token is
+    // kept so malformed values such as 'rgb(2 55,0,0)' or 'rgb(25 %,0%,0%)' are
+    // still rejected. Two linear passes avoid polynomial backtracking (#2885)
+    str = str.replace(/\s+/g, ' ').replace(/ ?([(),]) ?/g, '$1');
   }
 
   if (!includePercentValues) {
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..cd9eb9156 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -5309,11 +5309,15 @@ describe('Validators', () => {
         'rgba(255, 255, 255, 0.1)',
         'rgb(5% ,5% ,5%)',
         'rgba(5%,5%,5%, .3)',
+        'rgb( 255 , 0 , 0 )',
       ],
       invalid: [
         'r         g    b(   0,         251,       222     )',
         'rgb(4,4,5%)',
         'rgb(101%,101%,101%)',
+        'rgb(2 55,0,0)',
+        'rgba(0,0,0,0. 5)',
+        'rgb(25 %,0%,0%)',
 
       ],
     });