`isISO8601` strict mode never validates week dates

Open Beginner friendly
#2,859 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
backend

Research direction

Start by running the provided Node reproductions, then inspect the isValidDate strict-mode path around the month/day extraction and line 31. Done means strict mode rejects nonexistent week dates such as 2019-W53-1 and 2021-W53-1 while accepting valid 53-week dates such as 2015-W53-1 and 2020-W53-1.

Written by the indexing model from the issue text.

Description

🐛 bug

Describe the bug

With strict: true, isValidDate extracts month and day with

const match = str.match(/(\d{4})-?(\d{0,2})-?(\d*)/).map(Number);

For a week date such as 2021-W53-1 the W is not a digit, so (\d{0,2}) and
(\d*) both match the empty string. Number('') is 0, so the
if (month && day) guard at line 31 is false and the function returns true
without performing any check.

The effect is that strict: true never validates a week date at all. The
53rd week is accepted in years that only have 52 ISO weeks, and no week date
can ever be rejected by strict mode.

Examples

const validator = require('validator'); // 13.15.35

// 2019 and 2021 have 52 ISO weeks, so W53 does not exist in either
validator.isISO8601('2019-W53-1', { strict: true }); // true, expected false
validator.isISO8601('2021-W53-1', { strict: true }); // true, expected false

// 2015 and 2020 genuinely have 53 ISO weeks, so these are correct by accident
validator.isISO8601('2015-W53-1', { strict: true }); // true
validator.isISO8601('2020-W53-1', { strict: true }); // true

Every one of those returns true through the same fall-through path, so the
two correct answers are not evidence of a working check.

Reproductions

The Examples block above runs as-is on Node after
npm install validator@13.15.35; no harness or scaffolding needed.

Additional context

Related to the rewrite proposed in #2564, but reported separately because the
underlying behavior is that strict mode silently skips week dates rather than
mis-validating them.

Validator.js version: 13.15.35
Node.js version: v26.7.0
OS platform: Linux

Dominant language
JavaScript
Stars
23.7k
Forks
2.5k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from validatorjs/validator.js

All issues in validatorjs/validator.js

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.