magento/magento2#40361: Fixed issue with customer address telephone v…

app/code/Magento/Customer/Model/Validator/Telephone.php

@@ -7,7 +7,7 @@
 
 namespace Magento\Customer\Model\Validator;
 
-use Magento\Customer\Model\Customer;
+use Magento\Customer\Model\Address;
 use Magento\Framework\Validator\AbstractValidator;
 
 /**
@@ -22,18 +22,19 @@ class Telephone extends AbstractValidator
      * \+: Matches the plus sign.
      * \-: Matches the hyphen.
      * \d: Digits (0-9).
+     * \s: Matches whitespace characters.
      */
-    private const PATTERN_TELEPHONE = '/(?:[\d\s\+\-\()]{1,20})/u';
-    
+    private const PATTERN_TELEPHONE = '/^[\d\s\+\-\()]{1,20}$/u';
+
     /**
      * Validate telephone fields.
      *
-     * @param Customer $customer
+     * @param \Magento\Customer\Model\Address $value
      * @return bool
      */
-    public function isValid($customer)
+    public function isValid($value): bool
     {
-        if (!$this->isValidTelephone($customer->getTelephone())) {
+        if (!$this->isValidTelephone((string)$value->getTelephone())) {
             parent::_addMessages([[
                 'telephone' => "Invalid Phone Number. Please use 0-9, +, -, (, ) and space."
             ]]);
@@ -48,12 +49,10 @@ public function isValid($customer)
      * @param string|null $telephoneValue
      * @return bool
      */
-    private function isValidTelephone($telephoneValue)
+    private function isValidTelephone(?string $telephoneValue): bool
     {
         if ($telephoneValue != null) {
-            if (preg_match(self::PATTERN_TELEPHONE, (string) $telephoneValue, $matches)) {
-                return $matches[0] == $telephoneValue;
-            }
+            return preg_match(self::PATTERN_TELEPHONE, $telephoneValue) === 1;
         }
 
         return true;

app/code/Magento/Customer/Test/Unit/Model/Validator/TelephoneTest.php

@@ -8,7 +8,7 @@
 namespace Magento\Customer\Test\Unit\Model\Validator;
 
 use Magento\Customer\Model\Validator\Telephone;
-use Magento\Customer\Model\Customer;
+use Magento\Customer\Model\Address;
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
@@ -27,18 +27,18 @@ class TelephoneTest extends TestCase
     private Telephone $nameValidator;
 
     /**
-     * @var Customer|MockObject
+     * @var Address|MockObject
      */
-    private MockObject $customerMock;
+    private MockObject $addressMock;
 
     /**
      * @return void
      */
     protected function setUp(): void
     {
         $this->nameValidator = new Telephone;
-        $this->customerMock = $this->createPartialMockWithReflection(
-            Customer::class,
+        $this->addressMock = $this->createPartialMockWithReflection(
+            Address::class,
             ['getTelephone']
         );
     }
@@ -54,12 +54,30 @@ public function testValidateCorrectPunctuationInNames(
         string $telephone,
         string $message
     ) {
-        $this->customerMock->expects($this->once())->method('getTelephone')->willReturn($telephone);
+        $this->addressMock->expects($this->once())->method('getTelephone')->willReturn($telephone);
 
-        $isValid = $this->nameValidator->isValid($this->customerMock);
+        $isValid = $this->nameValidator->isValid($this->addressMock);
         $this->assertTrue($isValid, $message);
     }
 
+    /**
+     * Test for invalid characters in telephone numbers
+     *
+     * @param string $telephone
+     * @param string $message
+     * @return void
+     */
+    #[DataProvider('invalidTelephoneDataProvider')]
+    public function testValidateInvalidTelephone(
+        string $telephone,
+        string $message
+    ) {
+        $this->addressMock->expects($this->once())->method('getTelephone')->willReturn($telephone);
+
+        $isValid = $this->nameValidator->isValid($this->addressMock);
+        $this->assertFalse($isValid, $message);
+    }
+
     /**
      * @return array
      */
@@ -81,6 +99,57 @@ public static function expectedPunctuationInNamesDataProvider(): array
             [
                 'telephone' => '123456789',
                 'message' => 'Digits (numbers) must be allowed in telephone'
+            ],
+            [
+                'telephone' => '(123) 456-7890',
+                'message' => 'spaces must be allowed in telephone'
+            ]
+        ];
+    }
+
+    /**
+     * Data provider for invalid telephone numbers
+     *
+     * @return array
+     */
+    public static function invalidTelephoneDataProvider(): array
+    {
+        return [
+            [
+                'telephone' => '123абв456',
+                'message' => 'Cyrillic characters should not be allowed in telephone'
+            ],
+            [
+                'telephone' => '123abc456',
+                'message' => 'Latin letters should not be allowed in telephone'
+            ],
+            [
+                'telephone' => 'aaaaaa',
+                'message' => 'Pure alphabetic string should not be allowed in telephone'
+            ],
+            [
+                'telephone' => '123@456',
+                'message' => 'Special character @ should not be allowed in telephone'
+            ],
+            [
+                'telephone' => '123#456',
+                'message' => 'Special character # should not be allowed in telephone'
+            ],
+            [
+                'telephone' => '123$456',
+                'message' => 'Special character $ should not be allowed in telephone'
+            ],
+            [
+                'telephone' => '123.456.7890',
+                'message' => 'Dots should not be allowed in telephone'
+            ],
+            [
+                'telephone' => '123456789012345678901',
+                'message' => 'Telephone number longer than 20 characters should not be allowed'
+            ],
+            [
+                'telephone' => '<' . 'script>alert("xss")<' . '/script>',
+                'message' => 'XSS attempt should not be allowed in telephone'
             ]
         ];
     }