From d13fbae48acb3d34b44d12461fe0cd7b51150401 Mon Sep 17 00:00:00 2001
From: Siid Sharma <siid123ck@gmail.com>
Date: Fri, 6 Nov 2026 09:16:00 +0000
Subject: [PATCH] fix(isRgbColor): don't strip whitespace inside values when
 allowSpaces is true

With { allowSpaces: true } the validator stripped every whitespace character before testing the numeric patterns, so malformed values whose whitespace fell inside a token were accepted: rgb(2 55,0,0), rgba(0,0,0,0. 5) and rgb(25 %,0%,0%) all returned true.

Collapse whitespace runs and then strip only the whitespace around ( ) and ,, so whitespace around the comma-separated values keeps working while whitespace inside a channel, alpha or percent token is rejected.

Fixes #2885
---
 src/lib/isRgbColor.js   | 4 ++--
 test/validators.test.js | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/lib/isRgbColor.js b/src/lib/isRgbColor.js
index e9fb60253..96a99de35 100644
--- a/src/lib/isRgbColor.js
+++ b/src/lib/isRgbColor.js
@@ -27,8 +27,8 @@ export default function isRgbColor(str, options) {
     if (!startsWithRgb.test(str)) {
       return false;
     }
-    // strip all whitespace
-    str = str.replace(/\s/g, '');
+    // collapse whitespace runs, then strip only the whitespace around ( ) and ,
+    str = str.replace(/\s+/g, ' ').replace(/ ?([(),]) ?/g, '$1');
   }
 
   if (!includePercentValues) {
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..8698fe270 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -5290,6 +5290,8 @@ describe('Validators', () => {
         'rgba(3,3,3%,.3)',
         'rgb(101%, 101%, 101%)',
         'rgba(3%,3%,101%,0.3)',
+        'rgb(2 55,0,0)',
+        'rgba(0,0,0,0. 5)',
       ],
 
     });
@@ -5309,11 +5311,18 @@ describe('Validators', () => {
         'rgba(255, 255, 255, 0.1)',
         'rgb(5% ,5% ,5%)',
         'rgba(5%,5%,5%, .3)',
+        'rgb( 255 , 0 , 0 )',
+        'rgb (255,0,0)',
+        'rgb(255,0,0) ',
       ],
       invalid: [
         'r         g    b(   0,         251,       222     )',
         'rgb(4,4,5%)',
         'rgb(101%,101%,101%)',
+        'rgb(2 55,0,0)',
+        'rgba(0,0,0,0. 5)',
+        'rgb(25 %,0%,0%)',
+        'rgb(2\t55,0,0)',
 
       ],
     });