fix(table-core): guard range filters against non-array values

.changeset/guard-range-filter-tuple.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/table-core': patch
+---
+
+Guard `resolveFilterValue` in `inNumberRange` and `inDateRange` against filter values that are not arrays. Previously a string was destructured per character (`'30'` became the range `[0, 3]`, filtering silently wrong) and a number, boolean or `Date` threw `TypeError: val is not iterable`. Such values now leave the range fully open and warn in development.

packages/table-core/src/features/column-filtering/filterFns.ts

@@ -280,7 +280,9 @@ export const filterFn_betweenInclusive = constructFilterFn({
  * Filter values are normalized so blank endpoints become open-ended and
  * reversed endpoints are swapped. Only real numbers can fall inside the
  * range: non-numeric row values (`null`, `undefined`, strings, booleans)
- * never match.
+ * never match. A filter value that is not an array leaves the range fully
+ * open and warns in development, instead of being split per character or
+ * throwing.
  */
 export const filterFn_inNumberRange = constructFilterFn({
   filter: (dataValue: number, filterValue: [number, number]) => {
@@ -294,6 +296,10 @@ export const filterFn_inNumberRange = constructFilterFn({
     return dataValue >= min && dataValue <= max
   },
   resolveFilterValue: (val: [any, any]) => {
+    if (!isRangeArray(val, 'inNumberRange')) {
+      return [-Infinity, Infinity] as const
+    }
+
     const [unsafeMin, unsafeMax] = val
 
     const parsedMin =
@@ -326,14 +332,20 @@ export const filterFn_inNumberRange = constructFilterFn({
  *
  * Row values and range endpoints may be `Date` objects, timestamps, or
  * parseable date strings. Blank or invalid endpoints become open-ended and
- * reversed endpoints are swapped. Rows without a valid date never match.
+ * reversed endpoints are swapped. Rows without a valid date never match. A
+ * filter value that is not an array leaves the range fully open and warns in
+ * development, instead of being split per character or throwing.
  */
 export const filterFn_inDateRange = constructFilterFn({
   filter: (dataValue: number, filterValue: [number, number]) => {
     const [min, max] = filterValue
     return dataValue >= min && dataValue <= max
   },
   resolveFilterValue: (val: [any, any]) => {
+    if (!isRangeArray(val, 'inDateRange')) {
+      return [-Infinity, Infinity] as const
+    }
+
     const [unsafeMin, unsafeMax] = val
 
     const parsedMin = toDateTimestamp(unsafeMin)
@@ -468,6 +480,31 @@ function testFalsy(val: any) {
   return val === undefined || val === null || val === ''
 }
 
+/**
+ * Guards a range filter value before it is destructured.
+ *
+ * `[any, any]` only exists at compile time: at runtime `setFilterValue()` can
+ * be handed anything. Destructuring a string splits it per character (`'30'`
+ * becomes `'3'` and `'0'`, a range nothing asked for), and destructuring a
+ * number, boolean or `Date` throws. `autoRemove` does not catch either case,
+ * since it only drops falsy values and fully blank tuples. Arrays of any
+ * length pass through to the existing endpoint handling unchanged.
+ */
+function isRangeArray(val: any, filterFnName: string): val is Array<any> {
+  if (Array.isArray(val)) {
+    return true
+  }
+
+  if (process.env.NODE_ENV === 'development') {
+    console.warn(
+      `filterFn '${filterFnName}' expects a [min, max] tuple, received:`,
+      val,
+    )
+  }
+
+  return false
+}
+
 function testValueEmpty(dataValue: any) {
   return dataValue == null || String(dataValue).trim() === ''
 }

packages/table-core/tests/unit/fns/filterFns.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   columnFilteringFeature,
   constructFilterFn,
@@ -917,6 +917,64 @@ describe('Number Range Filters', () => {
       ])
     })
 
+    describe('filterFn_inNumberRange.resolveFilterValue non-array guard', () => {
+      const resolve = filterFn_inNumberRange.resolveFilterValue!
+
+      it('should leave the range open for a string instead of splitting it per character', () => {
+        // Destructuring `'30'` used to yield min `'3'`, max `'0'`, i.e. the
+        // range [0, 3] — a `<select>` sends strings, so this is reachable.
+        expect(resolve('30' as any)).toEqual([-Infinity, Infinity])
+        expect(resolve('7' as any)).toEqual([-Infinity, Infinity])
+        // A fresh tuple each time, so a caller writing into one cannot
+        // change what every later malformed value resolves to.
+        expect(resolve('30' as any)).not.toBe(resolve('7' as any))
+      })
+
+      it('should leave the range open for non-iterable values instead of throwing', () => {
+        expect(() => resolve(30 as any)).not.toThrow()
+        expect(resolve(30 as any)).toEqual([-Infinity, Infinity])
+        expect(resolve(new Date('2026-01-01') as any)).toEqual([
+          -Infinity,
+          Infinity,
+        ])
+        expect(resolve(true as any)).toEqual([-Infinity, Infinity])
+      })
+
+      it('should leave arrays to the existing endpoint handling', () => {
+        // Only non-arrays are guarded. An array is read by position exactly
+        // as before, so a lone endpoint stays an open-ended range.
+        expect(resolve([30] as any)).toEqual([30, Infinity])
+      })
+
+      // The guard warning only fires in development builds.
+      function spyOnDevWarnings() {
+        vi.stubEnv('NODE_ENV', 'development')
+        return vi.spyOn(console, 'warn').mockImplementation(() => {})
+      }
+
+      afterEach(() => {
+        vi.unstubAllEnvs()
+        vi.restoreAllMocks()
+      })
+
+      it('should warn once per resolve in development', () => {
+        const warn = spyOnDevWarnings()
+
+        resolve('30' as any)
+
+        expect(warn).toHaveBeenCalledTimes(1)
+        expect(warn.mock.calls[0]![0]).toContain('inNumberRange')
+      })
+
+      it('should not warn for a well-formed tuple', () => {
+        const warn = spyOnDevWarnings()
+
+        expect(resolve([29, 31])).toEqual([29, 31])
+
+        expect(warn).not.toHaveBeenCalled()
+      })
+    })
+
     it('should auto-remove only fully empty ranges', () => {
       const autoRemove = filterFn_inNumberRange.autoRemove!
 
@@ -1094,6 +1152,11 @@ describe('filterFn_empty / filterFn_notEmpty', () => {
 describe('filterFn_inDateRange', () => {
   const resolve = filterFn_inDateRange.resolveFilterValue!
 
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.restoreAllMocks()
+  })
+
   function makeValueRow(value: unknown) {
     const sampleTable = constructTable<typeof features, { value: unknown }>({
       features,
@@ -1114,6 +1177,26 @@ describe('filterFn_inDateRange', () => {
     ])
   })
 
+  it('leaves the range open for filter values that are not arrays', () => {
+    // The guard warning only fires in development builds.
+    vi.stubEnv('NODE_ENV', 'development')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    // Every character used to be run through `new Date()`, so both of these
+    // resolved to the same nonsensical range around the year 2000.
+    expect(resolve('2026-06-15' as any)).toEqual([-Infinity, Infinity])
+    expect(resolve('2026' as any)).toEqual([-Infinity, Infinity])
+    // A bare Date is not iterable: destructuring it threw a TypeError.
+    expect(() => resolve(new Date('2026-01-01') as any)).not.toThrow()
+    expect(resolve(new Date('2026-01-01') as any)).toEqual([
+      -Infinity,
+      Infinity,
+    ])
+    expect(warn.mock.calls[0]![0]).toContain('inDateRange')
+    // A fresh tuple each time, as for `inNumberRange`.
+    expect(resolve('2026' as any)).not.toBe(resolve('2027' as any))
+  })
+
   it('treats blank or invalid endpoints as open-ended and swaps reversed ranges', () => {
     const min = new Date('2026-01-01')