HTML Code

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Lodash _.sum — string trap</title>
</head>
<body>
  <h1>_.sum — string concatenation, null, undefined, NaN</h1>
  <pre id="out"></pre>
  <script src="https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js"></script>
  <script>
    (function () {
      var dirty = [1, "2", 3];
      var total = _.sum(dirty);
      var lines = [
        "String poison:",
        "  _.sum([1, '2', 3])         => " + total + "   (typeof " + typeof total + ")",
        "  _.sum(['42'])              => " + _.sum(["42"]) + "   (still a string, no coercion)",
        "",
        "null coerces to 0; undefined is skipped:",
        "  _.sum([1, null, 3])        => " + _.sum([1, null, 3]),
        "  _.sum([1, undefined, 3])   => " + _.sum([1, undefined, 3]),
        "",
        "NaN poisons:",
        "  _.sum([1, NaN, 3])         => " + _.sum([1, NaN, 3]),
        "",
        "Fix: coerce to numbers first",
        "  _.sum([1, '2', 3].map(Number)) => " + _.sum(dirty.map(Number))
      ];
      document.getElementById("out").textContent = lines.join("\n");
    })();
  </script>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

Lodash _.sum — the string-concat trap (Try It)