The Iban class constructor is quite lenient in what it accepts - it parses out all non-alphanumeric characters and does not validate its length. This makes it possible to construct IBANs like 1224114444DE or 11224
From a domain perspective this is problematic - domain objects should always be valid.
- Change constructor to only accept strings with a length of 34 chars, starting with 2 alphabetical uppercase characters and 32 numeric characters. Throw an exception if the constructor parameter does not match.
- Do all the necessary transformations (uppercase, removal of whitespace) in places where we cosntruct a new Iban class.