Tighten allowed notation for Simple parser

Author: Bart de Water

lib/money/parser/simple.rb

@@ -2,6 +2,8 @@
 class Money
   module Parser
     class Simple
+      SIGNED_DECIMAL_MATCHER = /\A-?\d*(?:\.\d*)?\z/.freeze
+
       class << self
         # Parses an input string using BigDecimal, it always expects a dot character as a decimal separator and
         # generally does not accept other characters other than minus-hyphen and digits. It is useful for APIs, interop
@@ -15,8 +17,8 @@ def parse(input, currency, strict: false)
           currency = Money::Helpers.value_to_currency(currency)
           return unless currency
 
-          amount = BigDecimal(input, exception: false)
-          if amount
+          coerced = input.to_s
+          if SIGNED_DECIMAL_MATCHER.match?(coerced) && (amount = BigDecimal(coerced, exception: false))
             Money.new(amount, currency)
           elsif strict
             raise ArgumentError, "unable to parse input=\"#{input}\" currency=\"#{currency}\""

spec/parser/simple_spec.rb

@@ -10,11 +10,15 @@
     it "parses an invalid string when not strict" do
       expect(described_class.parse("no money", "CAD")).to be_nil
       expect(described_class.parse("1..", "CAD")).to be_nil
+      expect(described_class.parse("10.", "CAD")).to be_nil
+      expect(described_class.parse("10.1E2", "CAD")).to be_nil
     end
 
     it "raises with an invalid string and strict option" do
       expect { described_class.parse("no money", "CAD", strict: true) }.to raise_error(ArgumentError)
       expect { described_class.parse("1..1", "CAD", strict: true) }.to raise_error(ArgumentError)
+      expect { described_class.parse("10.", "CAD", strict: true) }.to raise_error(ArgumentError)
+      expect { described_class.parse("10.1E2", "CAD", strict: true) }.to raise_error(ArgumentError)
     end
 
     it "parses an integer string amount" do
@@ -36,12 +40,14 @@
       expect(described_class.parse("$1.37", "CAD")).to be_nil
       expect(described_class.parse(",1.37", "CAD")).to be_nil
       expect(described_class.parse("€1.37", "CAD")).to be_nil
+      expect(described_class.parse(" 1.37", "CAD")).to be_nil
     end
 
     it "does not parse a float string amount with a trailing random character" do
       expect(described_class.parse("1.37$", "CAD")).to be_nil
       expect(described_class.parse("1.37,", "CAD")).to be_nil
       expect(described_class.parse("1.37€", "CAD")).to be_nil
+      expect(described_class.parse("1.37 ", "CAD")).to be_nil
     end
 
     it "does not parse an amount with one or more thousands separators" do