Repository: marshmallow-code/marshmallow

Issue:
RFC: extend allow_nan parameter to all number fields
`Decimal` field has an `allow_nan` parameter (`False` by default):

> If `True`, `NaN`, `Infinity` and `-Infinity` are allowed, even though they are illegal according to the JSON specification.

Any objection to extend it to all numbers?

Currently, `Int` will reject those as they are not integers, but they pass `Float` which just pawned me.

Should we add the same validation in `Float`? Move it up to `Number`?

Even if it is useless for `Int`, I'd be tempted to extend it to `Number`.

- Those are special values with a special meaning so a different error message makes sense.
- Any `Number` subclass would inherit it -> less duplication.

This is a breaking change as the default would be `False` so `Float` would need to be explicitly passed `allow_none=True`.

Discussion:

Patch:
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index bfe5bf52..d531cad7 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -6,12 +6,17 @@ Changelog
 
 Features:
 
-- Add ``fields.Pluck`` for serializing a single field from a nested object (:issue:`800`). Thanks :user:`timc13` for the
-  feedback and :user:`deckar01` for the implementation.
-- *Backwards-incompatible*: Passing a string argument as ``only`` to ``fields.Nested`` is no longer supported.
-  Use ``fields.Pluck`` instead (:issue:`800`).
+- Add ``fields.Pluck`` for serializing a single field from a nested object
+  (:issue:`800`). Thanks :user:`timc13` for the feedback and :user:`deckar01`
+  for the implementation.
+- *Backwards-incompatible*: Passing a string argument as ``only`` to
+  ``fields.Nested`` is no longer supported. Use ``fields.Pluck`` instead
+  (:issue:`800`).
 - Raise a `StringNotCollectionError` if ``only`` or ``exclude`` is
   passed as a string to ``fields.Nested`` (:pr:`931`).
+- *Backwards-incompatible*: ``Float`` takes an ``allow_nan`` parameter to
+  explicitly allow serializing and deserializing special values (``nan``,
+  ``inf`` and ``-inf``). ``allow_nan`` defaults to ``False``.
 
 Other changes:
 
diff --git a/docs/upgrading.rst b/docs/upgrading.rst
index 71e8eb20..7e576520 100644
--- a/docs/upgrading.rst
+++ b/docs/upgrading.rst
@@ -569,7 +569,7 @@ Processors that mutate the data should be updated to also return it.
             in_data['slug'] = in_data['slug'].lower().strip().replace(' ', '-')
             return in_data
 
-The Nested field no longer supports plucking
+``Nested`` field no longer supports plucking
 ********************************************
 
 In marshmallow 2.x, when a string was passed to a ``Nested`` field's ```only`` parameter, the field would be plucked. In marshmallow 3.x, the ``Pluck`` field must be used instead.
@@ -587,7 +587,31 @@ In marshmallow 2.x, when a string was passed to a ``Nested`` field's ```only`` p
         name = fields.Str()
         friends = fields.Pluck('self', 'name', many=True)
 
+``Float`` field takes a new ``allow_nan`` parameter
+***************************************************
 
+In marshmallow 2.x, ``Float`` field would serialize and deserialize special values such as ``nan``, ``inf`` or ``-inf``. In marshmallow 3, those values trigger a ``ValidationError`` unless ``allow_nan`` is ``True``. ``allow_nan`` defaults to ``False``.
+
+
+.. code-block:: python
+
+    # 2.x
+    class MySchema(Schema):
+        x = fields.Float()
+
+    MySchema().load({'x': 'nan'})
+    # => {{'x': nan}}
+
+    # 3.x
+    class MySchema(Schema):
+        x = fields.Float()
+        y = fields.Float(allow_nan=True)
+
+    MySchema().load({'x': 12, 'y': 'nan'})
+    # => {{'x': 12.0, 'y': nan}}
+
+    MySchema().load({'x': 'nan'})
+    # marshmallow.exceptions.ValidationError: {'x': ['Special numeric values (nan or infinity) are not permitted.']}
 
 Upgrading to 2.3
 ++++++++++++++++
diff --git a/marshmallow/fields.py b/marshmallow/fields.py
index 13bad238..b0580fd3 100755
--- a/marshmallow/fields.py
+++ b/marshmallow/fields.py
@@ -9,6 +9,7 @@ import numbers
 import uuid
 import warnings
 import decimal
+import math
 
 from marshmallow import validate, utils, class_registry
 from marshmallow.base import FieldABC, SchemaABC
@@ -667,18 +668,15 @@ class Number(Field):
 
     def _format_num(self, value):
         """Return the number value for value, given this field's `num_type`."""
-        if value is None:
-            return None
         # (value is True or value is False) is ~5x faster than isinstance(value, bool)
         if value is True or value is False:
-            raise TypeError(
-                'value must be a Number, not a boolean.  value is '
-                '{}'.format(value),
-            )
+            raise TypeError('value must be a Number, not a boolean.')
         return self.num_type(value)
 
     def _validated(self, value):
         """Format the value or raise a :exc:`ValidationError` if an error occurs."""
+        if value is None:
+            return None
         try:
             return self._format_num(value)
         except (TypeError, ValueError):
@@ -720,6 +718,33 @@ class Integer(Number):
         return super(Integer, self)._format_num(value)
 
 
+class Float(Number):
+    """
+    A double as IEEE-754 double precision string.
+
+    :param bool allow_nan: If `True`, `NaN`, `Infinity` and `-Infinity` are allowed,
+        even though they are illegal according to the JSON specification.
+    :param bool as_string: If True, format the value as a string.
+    :param kwargs: The same keyword arguments that :class:`Number` receives.
+    """
+
+    num_type = float
+    default_error_messages = {
+        'special': 'Special numeric values (nan or infinity) are not permitted.',
+    }
+
+    def __init__(self, allow_nan=False, as_string=False, **kwargs):
+        self.allow_nan = allow_nan
+        super(Float, self).__init__(as_string=as_string, **kwargs)
+
+    def _format_num(self, value):
+        num = super(Float, self)._format_num(value)
+        if self.allow_nan is False:
+            if math.isnan(num) or num == float('inf') or num == float('-inf'):
+                self.fail('special')
+        return num
+
+
 class Decimal(Number):
     """A field that (de)serializes to the Python ``decimal.Decimal`` type.
     It's safe to use when dealing with money values, percentages, ratios
@@ -760,7 +785,7 @@ class Decimal(Number):
     num_type = decimal.Decimal
 
     default_error_messages = {
-        'special': 'Special numeric values are not permitted.',
+        'special': 'Special numeric values (nan or infinity) are not permitted.',
     }
 
     def __init__(self, places=None, rounding=None, allow_nan=False, as_string=False, **kwargs):
@@ -771,9 +796,6 @@ class Decimal(Number):
 
     # override Number
     def _format_num(self, value):
-        if value is None:
-            return None
-
         num = decimal.Decimal(str(value))
 
         if self.allow_nan:
@@ -894,17 +916,6 @@ class FormattedString(Field):
             self.fail('format')
 
 
-class Float(Number):
-    """
-    A double as IEEE-754 double precision string.
-
-    :param bool as_string: If True, format the value as a string.
-    :param kwargs: The same keyword arguments that :class:`Number` receives.
-    """
-
-    num_type = float
-
-
 class DateTime(Field):
     """A formatted datetime string in UTC.
 


Test patch:
diff --git a/tests/test_deserialization.py b/tests/test_deserialization.py
index a0eb9c7f..f7a1f672 100644
--- a/tests/test_deserialization.py
+++ b/tests/test_deserialization.py
@@ -2,6 +2,7 @@
 import datetime as dt
 import uuid
 import decimal
+import math
 
 import pytest
 
@@ -229,7 +230,9 @@ class TestFieldDeserialization:
 
         with pytest.raises(ValidationError) as excinfo:
             field.deserialize(m1)
-        assert str(excinfo.value.args[0]) == 'Special numeric values are not permitted.'
+        assert str(excinfo.value.args[0]) == (
+            'Special numeric values (nan or infinity) are not permitted.'
+        )
         with pytest.raises(ValidationError):
             field.deserialize(m2)
         with pytest.raises(ValidationError):
@@ -245,6 +248,30 @@ class TestFieldDeserialization:
         assert isinstance(m7d, decimal.Decimal)
         assert m7d.is_zero() and m7d.is_signed()
 
+    @pytest.mark.parametrize('allow_nan', (None, False, True))
+    @pytest.mark.parametrize('value', ('nan', '-nan', 'inf', '-inf'))
+    def test_float_field_allow_nan(self, value, allow_nan):
+
+        if allow_nan is None:
+            # Test default case is False
+            field = fields.Float()
+        else:
+            field = fields.Float(allow_nan=allow_nan)
+
+        if allow_nan is True:
+            res = field.deserialize(value)
+            assert isinstance(res, float)
+            if value.endswith('nan'):
+                assert math.isnan(res)
+            else:
+                assert res == float(value)
+        else:
+            with pytest.raises(ValidationError) as excinfo:
+                field.deserialize(value)
+            assert str(excinfo.value.args[0]) == (
+                'Special numeric values (nan or infinity) are not permitted.'
+            )
+
     def test_string_field_deserialization(self):
         field = fields.String()
         assert field.deserialize('foo') == 'foo'
diff --git a/tests/test_serialization.py b/tests/test_serialization.py
index cb515b8d..5b977a36 100644
--- a/tests/test_serialization.py
+++ b/tests/test_serialization.py
@@ -5,6 +5,7 @@ import datetime as dt
 import itertools
 import decimal
 import uuid
+import math
 
 import pytest
 
@@ -312,6 +313,32 @@ class TestFieldSerialization:
         assert isinstance(m7s, decimal.Decimal)
         assert m7s.is_zero() and m7s.is_signed()
 
+    @pytest.mark.parametrize('allow_nan', (None, False, True))
+    @pytest.mark.parametrize('value', ('nan', '-nan', 'inf', '-inf'))
+    def test_float_field_allow_nan(self, value, allow_nan, user):
+
+        user.key = value
+
+        if allow_nan is None:
+            # Test default case is False
+            field = fields.Float()
+        else:
+            field = fields.Float(allow_nan=allow_nan)
+
+        if allow_nan is True:
+            res = field.serialize('key', user)
+            assert isinstance(res, float)
+            if value.endswith('nan'):
+                assert math.isnan(res)
+            else:
+                assert res == float(value)
+        else:
+            with pytest.raises(ValidationError) as excinfo:
+                field.serialize('key', user)
+            assert str(excinfo.value.args[0]) == (
+                'Special numeric values (nan or infinity) are not permitted.'
+            )
+
     def test_decimal_field_fixed_point_representation(self, user):
         """
         Test we get fixed-point string representation for a Decimal number that would normally