VBC-007: float-for-currency

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .astro
Scope: source code only, ignoring anything inside strings and comments
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/testdata/**, **/fixtures/**, **/test_*.py, **/*_test.py, **/test.py, **/conftest.py, **/*_test.go, **/*.test.*, **/*.spec.*
Tags: security clean-code

What it reports

Monetary value declared as a floating point literal at line {line}. Binary floats cannot represent decimal cents exactly. Store money as integer minor units or use a decimal type.

Flagged

const unitPrice = 19.99;

let taxRate = 0.22;

totalCost: 4.50

const weightedPrice = 4.5;

Not flagged

const unitPriceCents = 1999;

cost_weight = 0.3

const cfg = { costWeight: 0.7 };

const priceRatio = 0.5;

const unitPrice = 19.99;

const ratio = 0.22;

const feedback = 0.5;

const amount = 0.5;

const coffee = 1.5;

Pattern

\b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))(?![A-Za-z_$]*(?:[Ww]eight|[Rr]atio|[Ss]core|[Ff]actor|[Tt]hreshold|[Pp]enalty|[Mm]ultiplier|[Bb]ias|[Cc]oef))[A-Za-z_$]*\s*[:=]\s*[0-9]+\.[0-9]+