From 1cf22d17936637203a4901c40f7716a13513b14f Mon Sep 17 00:00:00 2001
From: Sahana Bogar <sahvx655@gmail.com>
Date: Fri, 17 Jul 2026 23:05:57 +0530
Subject: [PATCH] reject over-length codes in ISSNCheckDigit

---
 .../routines/checkdigit/ISSNCheckDigit.java   | 20 +++++++++++++++++++
 .../checkdigit/ISSNCheckDigitTest.java        | 16 +++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/src/main/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigit.java b/src/main/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigit.java
index 8b62f0838..9d5c77e9e 100644
--- a/src/main/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigit.java
+++ b/src/main/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigit.java
@@ -52,6 +52,9 @@ public final class ISSNCheckDigit extends ModulusCheckDigit {
 
     private static final long serialVersionUID = 1L;
 
+    /** An ISSN is exactly eight characters: seven digits plus the check digit. */
+    private static final int ISSN_LEN = 8;
+
     /**
      * Singleton ISSN Check Digit instance.
      */
@@ -64,6 +67,23 @@ public ISSNCheckDigit() {
         super(MODULUS_11);
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>
+     * The {@code 9 - leftPos} weighting gives a ninth character a weight of zero, so an over-length code left the
+     * trailing characters unweighted and still passed the modulus test (for example every {@code 03178471} + digit
+     * validated). The length is checked here so only a genuine eight-character ISSN reaches the check digit test.
+     * </p>
+     */
+    @Override
+    public boolean isValid(final String code) {
+        if (code != null && code.length() != ISSN_LEN) {
+            return false;
+        }
+        return super.isValid(code);
+    }
+
     @Override
     protected String toCheckDigit(final int charValue) throws CheckDigitException {
         if (charValue == 10) { // CHECKSTYLE IGNORE MagicNumber
diff --git a/src/test/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigitTest.java b/src/test/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigitTest.java
index a77ef6a4c..d39763bbb 100644
--- a/src/test/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigitTest.java
+++ b/src/test/java/org/apache/commons/validator/routines/checkdigit/ISSNCheckDigitTest.java
@@ -16,7 +16,11 @@
  */
 package org.apache.commons.validator.routines.checkdigit;
 
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 /**
  * ISSN Check Digit Test.
@@ -38,4 +42,16 @@ protected void setUp() {
         zeroSum = "00000000";
     }
 
+    /**
+     * An ISSN is exactly eight characters. Appending a character to a valid ISSN pushes the extra character to a
+     * position weighted zero (the routine weights each position by {@code 9 - leftPos}), so the modulus was unaffected
+     * and every over-length code validated. The first ten append a digit to a valid ISSN; the last is longer still.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = { "031784710", "031784711", "031784712", "031784713", "031784714", "031784715", "031784716", "031784717", "031784718", "031784719",
+            "0317847100", })
+    void testOverLengthRejected(final String code) {
+        assertFalse(routine.isValid(code), "Should fail (not eight characters): " + code);
+    }
+
 }