Reject Money values with more than 1000 integer digits

[elfassy]

Problem

Money.new accepts compact exponent-form amounts like "1e1000000000". Only NaN and Infinity are rejected. Storing the value is cheap, but #subunits (and every converter) calls to_i, and #to_s renders the full number. Both build an Integer or String sized by the exponent, so a 12-byte input can exhaust CPU and memory.

Measured locally on main:

Value	#subunits time
1e1000000	0.05 s
1e10000000	1.5 s
1e1000000000	not run (would hang the process)

The gem's own parsers (Simple, Fuzzy, Accounting, LocaleAware) already reject or neutralize this input. The exposure is apps that pass an untrusted string, BigDecimal or YAML value straight into Money.new or Money.from_amount.

Fix

Money#initialize raises ArgumentError when value.exponent > Helpers::MAX_INTEGER_DIGITS (1000). The check sits next to the NaN and Infinity checks, so it covers every construction path: strings, BigDecimals, from_subunits, YAML init_with, and arithmetic results.

Why 1000 digits

A 21-digit limit (to match the README's DECIMAL(21,3) column) was considered. It could break code that works today, such as intermediate arithmetic above 1e21 or using Money with the null currency as a general number container. 1000 digits is far beyond any real amount, and the largest allowed value still converts to an Integer under 1 KB.

Tests

• 8 new specs under magnitude bound: strings, BigDecimals, from_subunits, arithmetic overflow, YAML loading, the largest allowed value, values above DECIMAL(21,3), and ordinary exponent strings like "1.5e3".
• Without the fix, the 5 "raises" specs fail. The "largest value" spec also fails because it reads the new constant.
• With the fix: 747 examples, 0 failures, 100% line coverage. steep check is clean.

Notes

• Open PR Perf: trim allocations and checks on the Money.new construction path (-10% time, -25% allocs) #530 rewrites the same NaN and Infinity lines in initialize. Whichever lands second needs a small rebase.
• Consumers are protected only after a gem release and a version bump.
• Internal tracking: Vault 78027.

🤖 Generated with Claude Code