[masklinn]

> not the implicit fourth requirement that the function throws an exception for other inputs.

You could probably generate invalid inputs by taking a list of strings as input. Though of course at that point the property test has to reimplement half the function.

That's an issue I often end up having with property tests: the oracle for interesting properties is as complex as the SUT, so you end up with two of them.