1+ <!DOCTYPE html> < html lang ="en "> < head > < meta charSet ="utf-8 "/> < meta http-equiv ="X-UA-Compatible " content ="IE=edge "/> < title > FAQ · express-validator</ title > < meta name ="viewport " content ="width=device-width "/> < meta name ="generator " content ="Docusaurus "/> < meta name ="description " content ="## Why arrays are not validated/sanitized correctly? "/> < meta name ="docsearch:version " content ="6.10.0 "/> < meta name ="docsearch:language " content ="en "/> < meta property ="og:title " content ="FAQ · express-validator "/> < meta property ="og:type " content ="website "/> < meta property ="og:url " content ="https://express-validator.github.io/index.html "/> < meta property ="og:description " content ="## Why arrays are not validated/sanitized correctly? "/> < meta name ="twitter:card " content ="summary "/> < link rel ="shortcut icon " href ="/img/favicon.png "/> < link rel ="stylesheet " href ="https://cdn.jsdelivr.net/docsearch.js/1/docsearch.min.css "/> < link rel ="stylesheet " href ="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/styles/default.min.css "/> < script type ="text/javascript " src ="https://buttons.github.io/buttons.js "> </ script > < script src ="/js/scrollSpy.js "> </ script > < link rel ="stylesheet " href ="/css/main.css "/> < script src ="/js/codetabs.js "> </ script > </ head > < body class ="sideNavVisible separateOnPageNav "> < div class ="fixedHeaderContainer "> < div class ="headerWrapper wrapper "> < header > < a href ="/ "> < img class ="logo " src ="/img/logo.svg " alt ="express-validator "/> < h2 class ="headerTitleWithLogo "> express-validator</ h2 > </ a > < a href ="/versions.html "> < h3 > 6.10.0</ h3 > </ a > < div class ="navigationWrapper navigationSlider "> < nav class ="slidingNav "> < ul class ="nav-site nav-site-internal "> < li class ="siteNavGroupActive "> < a href ="/docs/6.10.0/index.html " target ="_self "> Docs</ a > </ li > < li class ="siteNavGroupActive "> < a href ="/docs/6.10.0/check-api.html " target ="_self "> API</ a > </ li > < li class =""> < a href ="https://github.com/express-validator/express-validator " target ="_self "> GitHub</ a > </ li > < li class ="navSearchWrapper reactNavSearchWrapper "> < input type ="text " id ="search_input_react " placeholder ="Search " title ="Search "/> </ li > </ ul > </ nav > </ div > </ header > </ div > </ div > < div class ="navPusher "> < div class ="docMainWrapper wrapper "> < div class ="docsNavContainer " id ="docsNav "> < nav class ="toc "> < div class ="toggleNav "> < section class ="navWrapper wrapper "> < div class ="navBreadcrumb wrapper "> < div class ="navToggle " id ="navToggler "> < div class ="hamburger-menu "> < div class ="line1 "> </ div > < div class ="line2 "> </ div > < div class ="line3 "> </ div > </ div > </ div > < h2 > < i > ›</ i > < span > More</ span > </ h2 > < div class ="tocToggler " id ="tocToggler "> < i class ="icon-toc "> </ i > </ div > </ div > < div class ="navGroups "> < div class ="navGroup "> < h3 class ="navGroupCategoryTitle "> Introduction</ h3 > < ul class =""> < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/index.html "> Getting Started</ a > </ li > </ ul > </ div > < div class ="navGroup "> < h3 class ="navGroupCategoryTitle "> Features</ h3 > < ul class =""> < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/sanitization.html "> Sanitization</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/custom-validators-sanitizers.html "> Custom validators/sanitizers</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/custom-error-messages.html "> Custom Error Messages</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/wildcards.html "> Wildcards</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/schema-validation.html "> Schema Validation</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/whole-body-validation.html "> Whole Body Validation</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/running-imperatively.html "> Running validations imperatively</ a > </ li > </ ul > </ div > < div class ="navGroup "> < h3 class ="navGroupCategoryTitle "> API</ h3 > < ul class =""> < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/check-api.html "> Validation middlewares</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/validation-chain-api.html "> Validation Chain API</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/filter-api.html "> Sanitization middlewares</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/sanitization-chain-api.html "> Sanitization Chain API</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/matched-data-api.html "> matchedData()</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/validation-result-api.html "> validationResult()</ a > </ li > </ ul > </ div > < div class ="navGroup "> < h3 class ="navGroupCategoryTitle "> More</ h3 > < ul class =""> < li class ="navListItem navListItemActive "> < a class ="navItem " href ="/docs/6.10.0/faq.html "> FAQ</ a > </ li > < li class ="navListItem "> < a class ="navItem " href ="/docs/6.10.0/migration-v5-to-v6.html "> Migration from v5 to v6</ a > </ li > </ ul > </ div > </ div > </ section > </ div > < script >
2+ var coll = document . getElementsByClassName ( 'collapsible' ) ;
3+ var checkActiveCategory = true ;
4+ for ( var i = 0 ; i < coll . length ; i ++ ) {
5+ var links = coll [ i ] . nextElementSibling . getElementsByTagName ( '*' ) ;
6+ if ( checkActiveCategory ) {
7+ for ( var j = 0 ; j < links . length ; j ++ ) {
8+ if ( links [ j ] . classList . contains ( 'navListItemActive' ) ) {
9+ coll [ i ] . nextElementSibling . classList . toggle ( 'hide' ) ;
10+ coll [ i ] . childNodes [ 1 ] . classList . toggle ( 'rotate' ) ;
11+ checkActiveCategory = false ;
12+ break ;
13+ }
14+ }
15+ }
16+
17+ coll [ i ] . addEventListener ( 'click' , function ( ) {
18+ var arrow = this . childNodes [ 1 ] ;
19+ arrow . classList . toggle ( 'rotate' ) ;
20+ var content = this . nextElementSibling ;
21+ content . classList . toggle ( 'hide' ) ;
22+ } ) ;
23+ }
24+
25+ document . addEventListener ( 'DOMContentLoaded' , function ( ) {
26+ createToggler ( '#navToggler' , '#docsNav' , 'docsSliderActive' ) ;
27+ createToggler ( '#tocToggler' , 'body' , 'tocActive' ) ;
28+
29+ var headings = document . querySelector ( '.toc-headings' ) ;
30+ headings && headings . addEventListener ( 'click' , function ( event ) {
31+ var el = event . target ;
32+ while ( el !== headings ) {
33+ if ( el . tagName === 'A' ) {
34+ document . body . classList . remove ( 'tocActive' ) ;
35+ break ;
36+ } else {
37+ el = el . parentNode ;
38+ }
39+ }
40+ } , false ) ;
41+
42+ function createToggler ( togglerSelector , targetSelector , className ) {
43+ var toggler = document . querySelector ( togglerSelector ) ;
44+ var target = document . querySelector ( targetSelector ) ;
45+
46+ if ( ! toggler ) {
47+ return ;
48+ }
49+
50+ toggler . onclick = function ( event ) {
51+ event . preventDefault ( ) ;
52+
53+ target . classList . toggle ( className ) ;
54+ } ;
55+ }
56+ } ) ;
57+ </ script > </ nav > </ div > < div class ="container mainContainer docsContainer "> < div class ="wrapper "> < div class ="post "> < header class ="postHeader "> < a class ="edit-page-link button " href ="https://github.com/express-validator/express-validator/edit/master/docs/faq.md " target ="_blank " rel ="noreferrer noopener "> Edit</ a > < h1 id ="__docusaurus " class ="postHeaderTitle "> FAQ</ h1 > </ header > < article > < div > < span > < h2 > < a class ="anchor " aria-hidden ="true " id ="why-arrays-are-not-validatedsanitized-correctly "> </ a > < a href ="#why-arrays-are-not-validatedsanitized-correctly " aria-hidden ="true " class ="hash-link "> < svg class ="hash-link-icon " aria-hidden ="true " height ="16 " version ="1.1 " viewBox ="0 0 16 16 " width ="16 "> < path fill-rule ="evenodd " d ="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z "> </ path > </ svg > </ a > Why arrays are not validated/sanitized correctly?</ h2 >
58+ < p > When using < a href ="/docs/6.10.0/validation-chain-api.html#standard-validators "> Standard validators</ a > and < a href ="/docs/6.10.0/sanitization-chain-api.html#standard-sanitizers "> Standard sanitizers</ a > from < a href ="https://github.com/validatorjs/validator.js "> validator.js</ a > the value is transformed to < code > string</ code > using this function:</ p >
59+ < pre > < code class ="hljs css language-ts "> < span class ="hljs-keyword "> export</ span > < span class ="hljs-function "> < span class ="hljs-keyword "> function</ span > < span class ="hljs-title "> toString</ span > (< span class ="hljs-params "> value: < span class ="hljs-built_in "> any</ span > , deep = < span class ="hljs-literal "> true</ span > </ span > ): < span class ="hljs-title "> string</ span > </ span > {
60+ < span class ="hljs-keyword "> if</ span > (< span class ="hljs-built_in "> Array</ span > .isArray(value) && value.length && deep) {
61+ < span class ="hljs-keyword "> return</ span > toString(value[< span class ="hljs-number "> 0</ span > ], < span class ="hljs-literal "> false</ span > );
62+ } < span class ="hljs-keyword "> else</ span > < span class ="hljs-keyword "> if</ span > (value < span class ="hljs-keyword "> instanceof</ span > < span class ="hljs-built_in "> Date</ span > ) {
63+ < span class ="hljs-keyword "> return</ span > value.toISOString();
64+ } < span class ="hljs-keyword "> else</ span > < span class ="hljs-keyword "> if</ span > (value && < span class ="hljs-keyword "> typeof</ span > value === < span class ="hljs-string "> 'object'</ span > && value.toString) {
65+ < span class ="hljs-keyword "> if</ span > (< span class ="hljs-keyword "> typeof</ span > value.toString !== < span class ="hljs-string "> 'function'</ span > ) {
66+ < span class ="hljs-keyword "> return</ span > < span class ="hljs-built_in "> Object</ span > .getPrototypeOf(value).toString.call(value);
67+ }
68+ < span class ="hljs-keyword "> return</ span > value.toString();
69+ } < span class ="hljs-keyword "> else</ span > < span class ="hljs-keyword "> if</ span > (value == < span class ="hljs-literal "> null</ span > || (< span class ="hljs-built_in "> isNaN</ span > (value) && !value.length)) {
70+ < span class ="hljs-keyword "> return</ span > < span class ="hljs-string "> ''</ span > ;
71+ }
72+
73+ < span class ="hljs-keyword "> return</ span > < span class ="hljs-built_in "> String</ span > (value);
74+ }
75+ </ code > </ pre >
76+ < p > As we can see above, when validating or sanitizing an < code > array</ code > only the first element of it is processed.</ p >
77+ < blockquote >
78+ < p > You can use < a href ="/docs/6.10.0/wildcards.html "> wildcards</ a > to validate/sanitize all the values of the array.</ p >
79+ </ blockquote >
80+ < h3 > < a class ="anchor " aria-hidden ="true " id ="example "> </ a > < a href ="#example " aria-hidden ="true " class ="hash-link "> < svg class ="hash-link-icon " aria-hidden ="true " height ="16 " version ="1.1 " viewBox ="0 0 16 16 " width ="16 "> < path fill-rule ="evenodd " d ="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z "> </ path > </ svg > </ a > Example:</ h3 >
81+ < pre > < code class ="hljs css language-js "> < span class ="hljs-comment "> // weekdays: ['sunday', 100]</ span >
82+ body(< span class ="hljs-string "> 'weekdays'</ span > ).isString(); < span class ="hljs-comment "> // Passes validation</ span >
83+ body(< span class ="hljs-string "> 'weekdays.*'</ span > ).isString(); < span class ="hljs-comment "> // Does not pass validation</ span >
84+ </ code > </ pre >
85+ < p > In this example the first chain processes only the first element of the array and the validation erroneously passes.
86+ In the second one, instead, all the elements are validated and the chain correctly returns an error.</ p >
87+ < h3 > < a class ="anchor " aria-hidden ="true " id ="referenced-issues "> </ a > < a href ="#referenced-issues " aria-hidden ="true " class ="hash-link "> < svg class ="hash-link-icon " aria-hidden ="true " height ="16 " version ="1.1 " viewBox ="0 0 16 16 " width ="16 "> < path fill-rule ="evenodd " d ="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z "> </ path > </ svg > </ a > Referenced issues:</ h3 >
88+ < blockquote >
89+ < p > < a href ="https://github.com/express-validator/express-validator/issues/791 "> #791</ a > , < a href ="https://github.com/express-validator/express-validator/issues/883 "> #883</ a > , < a href ="https://github.com/express-validator/express-validator/issues/931 "> #931</ a > </ p >
90+ </ blockquote >
91+ </ span > </ div > </ article > </ div > < div class ="docs-prevnext "> < a class ="docs-prev button " href ="/docs/6.10.0/validation-result-api.html "> < span class ="arrow-prev "> ← </ span > < span class ="function-name-prevnext "> validationResult()</ span > </ a > < a class ="docs-next button " href ="/docs/6.10.0/migration-v5-to-v6.html "> < span > Migration from v5 to v6</ span > < span class ="arrow-next "> →</ span > </ a > </ div > </ div > </ div > < nav class ="onPageNav "> < ul class ="toc-headings "> < li > < a href ="#why-arrays-are-not-validatedsanitized-correctly "> Why arrays are not validated/sanitized correctly?</ a > < ul class ="toc-headings "> < li > < a href ="#example "> Example:</ a > </ li > < li > < a href ="#referenced-issues "> Referenced issues:</ a > </ li > </ ul > </ li > </ ul > </ nav > </ div > < footer class ="nav-footer " id ="footer "> < section class ="sitemap "> < a href ="/ " class ="nav-home "> < img src ="/img/logo.svg " alt ="express-validator " width ="66 " height ="58 "/> </ a > < div > < h5 > Docs</ h5 > < a href ="/docs/index.html "> Getting Started</ a > < a href ="/docs/check-api.html "> API Reference</ a > </ div > < div > < h5 > Community</ h5 > < a href ="http://stackoverflow.com/questions/tagged/express-validator " target ="_blank " rel ="noreferrer noopener "> Stack Overflow</ a > </ div > < div > < h5 > More</ h5 > < a href ="https://github.com/express-validator/express-validator "> GitHub</ a > < a class ="github-button " href ="https://github.com/express-validator/express-validator " data-icon ="octicon-star " data-count-href ="/express-validator/express-validator/stargazers " data-show-count ="true " data-count-aria-label ="# stargazers on GitHub " aria-label ="Star this project on GitHub "> Star</ a > </ div > </ section > < section class ="copyright "> Copyright © 2021 express-validator</ section > </ footer > </ div > < script type ="text/javascript " src ="https://cdn.jsdelivr.net/docsearch.js/1/docsearch.min.js "> </ script > < script >
92+ document . addEventListener ( 'keyup' , function ( e ) {
93+ if ( e . target !== document . body ) {
94+ return ;
95+ }
96+ // keyCode for '/' (slash)
97+ if ( e . keyCode === 191 ) {
98+ const search = document . getElementById ( 'search_input_react' ) ;
99+ search && search . focus ( ) ;
100+ }
101+ } ) ;
102+ </ script > < script >
103+ var search = docsearch ( {
104+
105+ apiKey : 'd6d85148b3b81778cf952442d4292bea' ,
106+ indexName : 'express-validator' ,
107+ inputSelector : '#search_input_react' ,
108+ algoliaOptions : { "facetFilters" :[ "type:lvl3" , "language:en" , "version:6.10.0" ] }
109+ } ) ;
110+ </ script > </ body > </ html >
0 commit comments