NL13TEST0123456789 is validated true

skwasjer / IbanNet

C# .NET IBAN validator, parser, builder and generator

Apache License 2.0

119 stars 31 forks source link

NL13TEST0123456789 is validated true #139

Open kimpenhaus opened 1 year ago

kimpenhaus commented 1 year ago

Describe the bug

iban NL13TEST0123456789 is validated as valid but actually is not - I think it might fit the rulesets but...

To Reproduce

// See https://aka.ms/new-console-template for more information

using IbanNet;

var validator = new IbanValidator();
var validationResult = validator.Validate("NL13TEST0123456789");

Console.WriteLine(validationResult.IsValid);

Expected behavior

IsValid == false

IbanNet library/version

[IbanNet 5.9.0]

.NET runtime

[.NET 7.0]

Operating system

[OSX 13.4]
[Azure AppService Windows ?]

NiKiZe commented 1 year ago

The extra check runs against any valid banks in the country. Is this valid BICs? Regardless it seems to be out of scope of this library to validate that part of the IBAN, instead you might want to validate on national BBAN level.

I would advise against adding checks that blocks users from using new/unknown banks, as there might not have been time to update before such accounts starts to be used.

kimpenhaus commented 1 year ago

I am not sure if I got you right :)

but I would appreciate if that could be an optional extra check (so the consumer could have the decision about validating strict - even on BBAN level - or not).

skwasjer commented 1 year ago

Bank code (and or branch) validation is currently not part of IbanNet, as I do not have access to a comprehensive list of BIC's or bank code abbreviations (nor do I have the capacity to maintain such a list for accuracy). And as @NiKiZe points out, technically it is not relevant to IBAN validation, but to BBAN validation. So rather, it is not really a bug, just a missing feature.

Besides getting this list there's a few options:

Provide it out-of-the-box (opt-in or not)
Make or extend an extension (contrib) library that just provides a custom IIbanValidationRule implementation. This has my preference as it puts the burden on maintaining BBAN validation outside of the responsibility of the core IbanNet library.

IbanNet also does not perform BBAN check digit validation for similar reasons, as I outlined here: https://github.com/skwasjer/IbanNet/wiki/IbanNet.Extensions.Bban

I'd be happy to facilitate but am a bit stuck to progress on this on my own.