bug: JSON literals are accepted as numeric survey prefill values

Note: It looks like a contributor already proposed a fix; please look at the Github description

Issue

Numeric survey prefill parsing currently accepts JSON literals like true, false, and null as numbers.

Examples:

?npsQuestionId=true
?ratingQuestionId=true
?npsQuestionId=null

Current behavior:

• parseNumber("true") returns 1
• parseNumber("false") returns 0
• parseNumber("null") returns 0
• NPS/rating validators can then accept those coerced values as valid numeric prefill answers

Expected behavior: numeric prefill values should only accept actual parsed numbers. JSON booleans/null should be rejected and ignored as invalid prefill values.

Impact

Malformed or incorrectly generated survey links can silently prefill real NPS/rating answers with unintended values instead of being ignored.

Fix

parseNumber now accepts only finite parsed JSON numbers, avoiding Number(...) coercion of booleans/null.

Tests

Added regression coverage for:

• parseNumber("true"), parseNumber("false"), and parseNumber("null")
• validateNPS("true") / validateNPS("null")
• validateRating(..., "true") / validateRating(..., "null")

Verified:

git diff --check
pnpm vitest run apps/web/modules/survey/link/lib/prefill/parsers.test.ts apps/web/modules/survey/link/lib/prefill/validators.test.ts
pnpm --filter @formbricks/web exec eslint modules/survey/link/lib/prefill/parsers.ts modules/survey/link/lib/prefill/parsers.test.ts modules/survey/link/lib/prefill/validators.test.ts

Branch: https://github.com/bharathkumar39293/formbricks/tree/fix/reject-json-literals-prefill-number

Since PR creation is restricted for contributors, I’m happy to open a PR if access is granted, or a maintainer can cherry-pick the commit.