Repository navigation
Validate international phone digit counts and whole-number boundaries #263
Description
The international phone rule in crates/tinymemory-api/src/safety/rules.rs uses a repetition over digits and separators, although its comment promises 7–15 digits. This rule is preserved from OpenHuman by PR259; the ownership migration does not change detection behavior.
A synthetic public-API probe of scan and redact_identifiers confirms:
- +1234567 (seven digits): no hit, unchanged.
- +123456789012345678 (18 digits): one PhoneNumber hit and redaction.
- +1 2 (two digits plus separators): one PhoneNumber hit and redaction.
Validate normalized digit counts and define whole-number boundaries so a too-long number cannot be accepted by truncating its prefix. Add focused regressions for 7/15-digit boundaries, 6/16-or-more digits, and separator-heavy values; preserve intended US-format behavior and address overlap with #261.
Activity
tinysweeper commentedon Oct 11, 2026
The international phone rule in crates/tinymemory-api/src/safety/rules.rs documents a 7–15 digit range but its digit/separator repetition accepts out-of-range values: a 2-digit separator-heavy string is redacted as a PhoneNumber and an 18-digit string is accepted (potentially via prefix truncation). Fix requires normalizing digit counts, enforcing whole-number boundaries, and adding regressions at the 6/7/15/16-digit edges plus separator-heavy inputs. It is a correctness bug in detection rather than a crash or data-loss path, so p2; it is related to but distinct from #261 (overlapping phone-rule counts), which it merely needs to be reconciled with.
Labelled
priority: p2.