`isISO8601` accepts any whitespace as the date-time separator

Open Beginner friendly
#2,861 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
tooling

Research direction

Start at the isISO8601 validation entry point and inspect the default date-time separator pattern. Reproduce the examples with Node after installing validator@13.15.35, then verify that only the permitted separators are accepted while tabs, newlines, form feeds, vertical tabs, and non-breaking spaces are rejected.

Written by the indexing model from the issue text.

Description

🐛 bug

Describe the bug

The date and time parts are separated by [T\s] in the default pattern. \s
matches tab, newline, form feed, vertical tab, and non-breaking space in
addition to a plain space, so all of them are accepted as ISO 8601 separators.

ISO 8601 itself permits only T. RFC 3339 §5.6 additionally allows a space by
convention, which is presumably why the class is there, but neither permits the
rest of \s.

Examples

const validator = require('validator'); // 13.15.35

validator.isISO8601('2009-01-01\t00:00:00');     // true (tab)
validator.isISO8601('2009-01-01\n00:00:00');     // true (newline)
validator.isISO8601('2009-01-01\f00:00:00');     // true (form feed)
validator.isISO8601('2009-01-01\v00:00:00');     // true (vertical tab)
validator.isISO8601('2009-01-01 00:00:00'); // true (non-breaking space)

Reproductions

The Examples block above runs as-is on Node after
npm install validator@13.15.35; no harness or scaffolding needed.

Additional context

strictSeparator: true rejects every one of these, so there is a working
opt-out. If the intent of the default mode is RFC 3339 leniency, then [T ]
expresses that exactly, whereas [T\s] admits four more characters that no
relevant specification allows. A newline in particular is worth rejecting,
since it lets a two-line input pass a single-value check.

Validator.js version: 13.15.35
Node.js version: v26.7.0
OS platform: Linux

Dominant language
JavaScript
Stars
23.7k
Forks
2.5k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from validatorjs/validator.js

All issues in validatorjs/validator.js

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.