This is an independent contribution submitted as part of an open-source contribution practice. It is not affiliated with any hackathon or competition.

Summary

The Mastercard regex pattern in isCreditCard has a regex operator precedence bug that causes it to accept partial strings like "5108" as valid credit card numbers.

Root Cause

The original regex:

/^5[1-5][0-9]{2}|(222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$/

Due to | having lower precedence than ^ and $, this parsed as two unanchored alternatives:

1. ^5[1-5][0-9]{2} — start-anchored only, matches any string beginning with 51XX–55XX regardless of length
2. (222[1-9]|...)[0-9]{12}$ — end-anchored only

This allowed inputs such as "5108" (4 digits) to pass the format check.

Fix

Wrapped the alternation in a non-capturing group so both anchors bind to all branches:

-  /^5[1-5][0-9]{2}|(222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$/
+  /^(?:5[1-5][0-9]{14}|(222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12})$/

Also fixed the 51-55 branch which was missing its trailing digit quantifier [0-9]{12}.

Testing

• All 318 existing tests pass (100% statement/function/line coverage)
• Manually verified "5108" now correctly returns false
• Manually verified valid Mastercard numbers like "5398228707871527" continue to return `true"

Closes #2717