fix: improve CLI number validation and add regression tests

phoekerson · phoekerson · commit 82f63692d05b · 2026-03-24T16:42:34.000Z
Ensure numeric inputs are strictly validated against DECIMAL_NUMBER_REGEXP
before conversion. Added tests to reject Infinity and hex values in
watch options to prevent ambiguous parsing.
diff --git a/lib/cli.js b/lib/cli.js
@@ -603,6 +603,8 @@ const getExpectedValue = (argConfig) => {
 
 /** @typedef {null | string | number | boolean | RegExp | EnumValue | []} ParsedValue */
 
+const DECIMAL_NUMBER_REGEXP = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
+
 /**
  * @param {ArgumentConfig} argConfig processing instructions
  * @param {Value} value the value
@@ -622,7 +624,10 @@ const parseValueForArgumentConfig = (argConfig, value) => {
 			break;
 		case "number":
 			if (typeof value === "number") return value;
-			if (typeof value === "string" && /^[+-]?\d*(\.\d*)e\d+$/i) {
+			if (
+				typeof value === "string" &&
+				DECIMAL_NUMBER_REGEXP.test(value)
+			) {
 				const n = Number(value);
 				if (!Number.isNaN(n)) return n;
 			}
diff --git a/test/Cli.basictest.js b/test/Cli.basictest.js
@@ -323,6 +323,8 @@ describe("Cli", () => {
 				"output-library-name": "non-object",
 				"resolve-loader-unsafe-cache": [true, false],
 				"output-chunk-load-timeout": "20000x",
+				"watch-options-aggregate-timeout": "Infinity",
+				"watch-options-poll": "0x10",
 				"cache-type": "filsystem",
 				"entry-reset": false,
 				"module-unknown-context-reg-exp": "ab?c*",
@@ -366,6 +368,30 @@ describe("Cli", () => {
 			    "type": "invalid-value",
 			    "value": "20000x",
 			  },
+			  Object {
+			    "argument": "watch-options-aggregate-timeout",
+			    "expected": "number",
+			    "index": undefined,
+			    "path": "watchOptions.aggregateTimeout",
+			    "type": "invalid-value",
+			    "value": "Infinity",
+			  },
+			  Object {
+			    "argument": "watch-options-poll",
+			    "expected": "number",
+			    "index": undefined,
+			    "path": "watchOptions.poll",
+			    "type": "invalid-value",
+			    "value": "0x10",
+			  },
+			  Object {
+			    "argument": "watch-options-poll",
+			    "expected": "true | false",
+			    "index": undefined,
+			    "path": "watchOptions.poll",
+			    "type": "invalid-value",
+			    "value": "0x10",
+			  },
 			  Object {
 			    "argument": "cache-type",
 			    "expected": "memory",
