VBC-007: float-for-currency

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security clean-code

What it reports

Monetary value declared as a floating point literal at line {line}. Binary floats cannot represent decimal cents exactly. Store money as integer minor units or use a decimal type.

Flagged

const unitPrice = 19.99;

let taxRate = 0.22;

totalCost: 4.50

Not flagged

const unitPriceCents = 1999;

const ratio = 0.22;

const feedback = 0.5;

const amount = 0.5;

const coffee = 1.5;

Pattern

\b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))[A-Za-z_$]*\s*[:=]\s*[0-9]+\.[0-9]+