Iban.isValid() method does not verify that the check digits match those that would be calculated

[edgeofoblivion]

jbanking/src/main/java/fr/marcwrobel/jbanking/iban/Iban.java

Line 156 in ac28e38

return IbanCheckDigit.INSTANCE.validate(normalized);

Hello,
I've seen an unusual instance where the Iban.isValid(String iban) method returns true for what I believe to be an invalid Iban.
At the bottom of the method ultimately a modulus check is performed:

return IbanCheckDigit.INSTANCE.validate(normalized);

But a variation of a valid Iban (as seen in the example below which is based on a valid entry from your test class set of randomly generated valid Ibans) can also pass this modulus check and return true - no check is done to see if the generated Iban check digits match those from the given iban parameter.

@Test
public void ibanLibraryTest() {

  String valid = "MD026JK24D0RFGDJJPJQHKWN";
  String dubious = "MD996JK24D0RFGDJJPJQHKWN";

  // both pass modulo check but the second assertion should really fail
  assertTrue(Iban.isValid(valid));
  assertTrue(Iban.isValid(dubious)); // this should fail

  // both instantiate ok
  Iban validIban = new Iban(valid);
  Iban dubiousIban = new Iban(dubious);

  String calculatedCheckDigits =
      IbanCheckDigit.INSTANCE.calculate(valid.substring(0, 2) + "00" + valid.substring(4)); // returns "02"

  // Calculated matches supplied from iban
  assertTrue(calculatedCheckDigits.equals(validIban.getCheckDigit()));

  // However, if this check was to be done we could tell that the supplied iban is dubious
  assertTrue(calculatedCheckDigits.equals(dubiousIban.getCheckDigit())); // assertion fails
}

Should some additional verification of the check digits be added to Iban.isValid() method?

[edgeofoblivion]

Apache Commons IBANCheckDigit class has an isValid method which simply first verifies the supplied iban has a check digit in the 02 - 98 range before then performing the modulus check.

[marcwrobel]

Thank you @edgeofoblivion for your report. The bug has been fixed and a new release of jbanking will be released today.