Joi.string().dataUri() validate incorrectly
- Dominant language
- JavaScript
- Stars
- 21.2k
- Forks
- 1.5k
- Avg merge
- 4h 57m
- Merged PRs (30d)
- 14
Description
#### Support plan
* *is this issue currently blocking your project?* (yes/no): No
* *is this issue affecting a production system?* (yes/no): No
#### Context
* *node version*: v15.6.0
* *module version with issue*: v17.4.0
* *last module version without issue*: Not Sure (Only started with this)
* *environment* (e.g. node, browser, native): node
* *used with* (e.g. hapi application, another framework, standalone, ...): standalone
* *any other relevant information*: Related to https://github.com/sideway/joi/blob/83092836583a7f4ce16cbf116b8776737e80d16f/lib/types/string.js#L29
#### What are you trying to achieve or the steps to reproduce?
```js
const Joi = require('joi');
const validator = require('validator');
const valid = [
'data:text/html,%3Ch1%3EHello%2C%20World!%3C%2Fh1%3E',
'data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==',
'data:,Hello%2C%20World!',
"data:text/html,alert('hi');",
'data:text/html;charset=,%3Ch1%3EHello!%3C%2Fh1%3E',
];
// false means validation failed
// true means validation passed
valid.forEach((val) => {
validatorRes = validator.isDataURI(val);
JoiRes = Joi.string().dataUri().validate(val).error ? false : true;
console.log(val);
console.log(`validator --> ${validatorRes}`);
console.log(`Joi --> ${JoiRes}`);
console.log('\n');
});
/*
data:text/html,%3Ch1%3EHello%2C%20World!%3C%2Fh1%3E
validator --> true
Joi --> false
data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==
validator --> true
Joi --> true
data:,Hello%2C%20World!
validator --> true
Joi --> false
data:text/html,alert('hi');
validator --> false
Joi --> false
data:text/html;charset=,%3Ch1%3EHello!%3C%2Fh1%3E
validator --> false
Joi --> true
*/
```
#### What was the result you got?
https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URIs
I tried validating against the examples from MDN and `validator` module from [https://github.com/validatorjs/validator.js](here)
The result I'm seeing is rather inconclusive. But the item last item in the `valid` array (`data:text/html;charset=,%3Ch1%3EHello!%3C%2Fh1%3E`) should be an invalid `dataURI`.
#### What result did you expect?
I am expecting that validation for `dataURI` is more complete, at least the first 3 items in the valid array should be valid.
#### My interpretation on the bug:
The implementation of regex for checking of `dataURI` seems to be inconclusive.
https://github.com/sideway/joi/blob/83092836583a7f4ce16cbf116b8776737e80d16f/lib/types/string.js#L29
Could we work towards something like
https://github.com/validatorjs/validator.js/blob/d1a9b6d8c5bd7350d6a7303085f0269f6a99aa9b/src/lib/isDataURI.js#L1-L38
I'm open to working on this if this is indeed a bug.
Contributor guide
Assessment
This issue has not been assessed yet.