From 8ed8a0844b04e2dcdc9cea829184d56c2c24736e Mon Sep 17 00:00:00 2001
From: pacocartones <manusanchezhl@gmail.com>
Date: Sun, 2 Aug 2026 10:57:23 +0200
Subject: [PATCH] fix(isVAT): escape dot separators in ID and BR VAT numbers

The ID (Indonesia) and BR (Brazil) matchers wrote their dot separators as
a bare `.`, which outside a character class is the "any character"
metacharacter rather than a literal dot. As a result malformed numbers
were accepted, e.g. isVAT('12X345.678.9-012.345', 'ID') and
isVAT('123X456.789-01', 'BR') both returned true.

Escape the separators (`.` -> `\.`) so only the printed NPWP
(XX.XXX.XXX.X-XXX.XXX), CNPJ (XX.XXX.XXX/XXXX-XX) and CPF
(XXX.XXX.XXX-XX) forms match. This matches the CH matcher in the same
file, which already writes `\d{3}\.\d{3}\.\d{3}`. Regression tests cover
each separator position.

Note this also stops hyphen- and space-separated variants that passed by
accident (e.g. '123 456 789-01' for BR); those are not valid renderings
of these numbers.
---
 src/lib/isVAT.js        | 4 ++--
 test/validators.test.js | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/lib/isVAT.js b/src/lib/isVAT.js
index 68aab5c12..0be3f7590 100644
--- a/src/lib/isVAT.js
+++ b/src/lib/isVAT.js
@@ -89,7 +89,7 @@ export const vatMatchers = {
   CA: str => /^(CA)?\d{9}$/.test(str),
   IS: str => /^(IS)?\d{5,6}$/.test(str),
   IN: str => /^(IN)?\d{15}$/.test(str),
-  ID: str => /^(ID)?(\d{15}|(\d{2}.\d{3}.\d{3}.\d{1}-\d{3}.\d{3}))$/.test(str),
+  ID: str => /^(ID)?(\d{15}|(\d{2}\.\d{3}\.\d{3}\.\d{1}-\d{3}\.\d{3}))$/.test(str),
   IL: str => /^(IL)?\d{9}$/.test(str),
   KZ: str => /^(KZ)?\d{12}$/.test(str),
   NZ: str => /^(NZ)?\d{9}$/.test(str),
@@ -111,7 +111,7 @@ export const vatMatchers = {
    */
   AR: str => /^(AR)?\d{11}$/.test(str),
   BO: str => /^(BO)?\d{7}$/.test(str),
-  BR: str => /^(BR)?((\d{2}.\d{3}.\d{3}\/\d{4}-\d{2})|(\d{3}.\d{3}.\d{3}-\d{2}))$/.test(str),
+  BR: str => /^(BR)?((\d{2}\.\d{3}\.\d{3}\/\d{4}-\d{2})|(\d{3}\.\d{3}\.\d{3}-\d{2}))$/.test(str),
   CL: str => /^(CL)?\d{8}-\d{1}$/.test(str),
   CO: str => /^(CO)?\d{10}$/.test(str),
   CR: str => /^(CR)?\d{9,12}$/.test(str),
diff --git a/test/validators.test.js b/test/validators.test.js
index cdde41a07..e24197f12 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -15688,6 +15688,11 @@ describe('Validators', () => {
       invalid: [
         'ID 123456789012345',
         '12345678901234',
+        '12X345.678.9-012.345',
+        '12/345.678.9-012.345',
+        '12.345X678.9-012.345',
+        '12.345.678X9-012.345',
+        '12.345.678.9-012X345',
       ],
     });
     test({
@@ -15947,6 +15952,10 @@ describe('Validators', () => {
       invalid: [
         'BR 12.345.678/9012-34',
         '12345678901234',
+        '12X345.678/9012-34',
+        '12.345X678/9012-34',
+        '123X456.789-01',
+        '123.456X789-01',
       ],
     });
     test({