Fix state leakage of otherCountryCodes in IBANValidator custom configurations

src/main/java/org/apache/commons/validator/routines/IBANValidator.java

@@ -376,7 +376,13 @@ public Validator setValidator(final String countryCode, final int length, final
             throw new IllegalStateException("The singleton validator cannot be modified");
         }
         if (length < 0) {
-            return validatorMap.remove(countryCode);
+            final Validator prev = validatorMap.remove(countryCode);
+            if (prev != null) {
+                for (final String otherCC : prev.otherCountryCodes) {
+                    validatorMap.remove(otherCC);
+                }
+            }
+            return prev;
         }
         return setValidator(new Validator(countryCode, length, format));
     }
@@ -393,7 +399,16 @@ public Validator setValidator(final Validator validator) {
         if (this == DEFAULT_IBAN_VALIDATOR) {
             throw new IllegalStateException("The singleton validator cannot be modified");
         }
-        return validatorMap.put(validator.countryCode, validator);
+        final Validator prev = validatorMap.put(validator.countryCode, validator);
+        if (prev != null) {
+            for (final String otherCC : prev.otherCountryCodes) {
+                validatorMap.remove(otherCC);
+            }
+        }
+        for (final String otherCC : validator.otherCountryCodes) {
+            validatorMap.put(otherCC, validator);
+        }
+        return prev;
     }
 
     /**

src/test/java/org/apache/commons/validator/routines/IBANValidatorTest.java

@@ -465,6 +465,46 @@ void testSetValidatorLen1() {
         assertNull(validator.setValidator("GB", -1, ""), "no longer present");
     }
 
+    @Test
+    void testSetValidatorCleanupOtherCountryCodes() {
+        final IBANValidator validator = new IBANValidator();
+
+        // Confirm GB (United Kingdom) handles IM (Isle of Man), JE (Jersey), GG (Guernsey) by default
+        assertTrue(validator.hasValidator("GB"));
+        assertTrue(validator.hasValidator("IM"));
+        assertTrue(validator.hasValidator("JE"));
+        assertTrue(validator.hasValidator("GG"));
+
+        // Remove GB validator
+        assertNotNull(validator.setValidator("GB", -1, null));
+
+        // Verify that GB and all associated territories are removed
+        assertFalse(validator.hasValidator("GB"));
+        assertFalse(validator.hasValidator("IM"));
+        assertFalse(validator.hasValidator("JE"));
+        assertFalse(validator.hasValidator("GG"));
+    }
+
+    @Test
+    void testSetValidatorReplaceOtherCountryCodes() {
+        final IBANValidator validator = new IBANValidator();
+
+        // Confirm GB handles IM by default
+        assertTrue(validator.hasValidator("GB"));
+        assertTrue(validator.hasValidator("IM"));
+        final Validator oldGbValidator = validator.getValidator("GB");
+        final Validator oldImValidator = validator.getValidator("IM");
+        assertEquals(oldGbValidator, oldImValidator);
+
+        // Replace GB validator with a custom one (which will have no other country codes)
+        final Validator newGbValidator = new Validator("GB", 22, "GB\\d{20}");
+        validator.setValidator(newGbValidator);
+
+        // Verify GB has the new validator, but IM no longer has the old validator
+        assertEquals(newGbValidator, validator.getValidator("GB"));
+        assertFalse(validator.hasValidator("IM"));
+    }
+
     @Test
     void testSetValidatorLen35() {
         final IBANValidator validator = new IBANValidator();