Security News
ESLint is Now Language-Agnostic: Linting JSON, Markdown, and Beyond
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
validator
Advanced tools
The validator npm package is a library of string validators and sanitizers. It provides a variety of functions to validate and sanitize strings, such as checking if a string is in a certain format (e.g., email, URL) or transforming strings to ensure they are safe for use in different contexts.
Email Validation
Checks if the input string is an email.
const validator = require('validator');
console.log(validator.isEmail('test@example.com')); // true
URL Validation
Checks if the input string is a URL.
const validator = require('validator');
console.log(validator.isURL('https://www.example.com')); // true
Sanitizing Strings
Escapes HTML characters in the input string to prevent XSS attacks.
const validator = require('validator');
console.log(validator.escape('<script>alert("xss")</script>')); // '<script>alert("xss")</script>'
Checking String Length
Checks if the input string's length falls within a specified range.
const validator = require('validator');
console.log(validator.isLength('Hello', {min: 2, max: 10})); // true
Blacklisting Characters
Removes specified characters from the input string.
const validator = require('validator');
console.log(validator.blacklist('abc123', '123')); // 'abc'
Joi is a powerful schema description language and data validator for JavaScript. It allows for a more detailed and structured validation process compared to validator, including the ability to create custom validation schemas.
Yup is a JavaScript schema builder for value parsing and validation. It uses a schema-based approach similar to Joi and can be integrated with form libraries like Formik. It is more focused on object schema validation.
Class-validator works with classes and decorators to validate that the properties of an object conform to specified rules. It is typically used with TypeScript and integrates well with class-based frameworks like TypeORM.
Express-validator is a set of express.js middlewares that wraps validator.js functions. It is specifically designed for use with the Express web application framework and allows for easy integration of validation into the request processing pipeline.
A library of string validators and sanitizers.
Install the library with npm install validator
var validator = require('validator');
validator.isEmail('foo@bar.com'); //=> true
import validator from 'validator';
Or, import only a subset of the library:
import isEmail from 'validator/lib/isEmail';
The library can be loaded either as a standalone script, or through an AMD-compatible loader
<script type="text/javascript" src="validator.min.js"></script>
<script type="text/javascript">
validator.isEmail('foo@bar.com'); //=> true
</script>
The library can also be installed through bower
$ bower install validator-js
This library validates and sanitizes strings only.
If you're not sure if your input is a string, coerce it using input + ''
.
Passing anything other than a string is an error.
['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'cs-CZ', 'da-DK', 'de-DE', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'es-ES', 'fr-FR', 'hu-HU', 'nb-NO', 'nl-NL', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'sr-RS', 'sr-RS@latin', 'tr-TR', 'uk-UA']
) and defaults to en-US
.['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'cs-CZ', 'da-DK', 'de-DE', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'es-ES', 'fr-FR', 'fr-BE', 'hu-HU', 'nl-BE', 'nb-NO', 'nl-NL', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'sr-RS', 'sr-RS@latin', 'tr-TR', 'uk-UA']
) and defaults to en-US
.options
is an object which defaults to {min:0, max: undefined}
.options
is an object which defaults to {symbol: '$', require_symbol: false, allow_space_after_symbol: false, symbol_after_digits: false, allow_negatives: true, parens_for_negatives: false, negative_sign_before_digits: false, negative_sign_after_digits: false, allow_negative_sign_placeholder: false, thousands_separator: ',', decimal_separator: '.', allow_space_after_digits: false }
.options
is an object which defaults to { allow_display_name: false, require_display_name: false, allow_utf8_local_part: true, require_tld: true }
. If allow_display_name
is set to true, the validator will also match Display Name <email-address>
. If require_display_name
is set to true, the validator will reject strings without the format Display Name <email-address>
. If allow_utf8_local_part
is set to false, the validator will not allow any non-English UTF8 character in email address' local part. If require_tld
is set to false, e-mail addresses without having TLD in their domain will also be matched.options
is an object which defaults to { require_tld: true, allow_underscores: false, allow_trailing_dot: false }
.options
is an object which can contain the keys min
, max
, gt
, and/or lt
to validate the float is within boundaries (e.g. { min: 7.22, max: 9.55 }
). min
and max
are equivalent to 'greater or equal' and 'less or equal', respectively while gt
and lt
are their strict counterparts.options
is an object which defaults to { case_sensitive: false, require_hyphen: false }
. If case_sensitive
is true, ISSNs with a lowercase 'x'
as the check digit are rejected.options
is an object which can contain the keys min
and/or max
to check the integer is within boundaries (e.g. { min: 10, max: 99 }
). options
can also contain the key allow_leading_zeroes
, which when set to false will disallow integer values with leading zeroes (e.g. { allow_leading_zeroes: false }
). Finally, options
can contain the keys gt
and/or lt
which will enforce integers being greater than or less than, respectively, the value provided (e.g. {gt: 1, lt: 4}
for a number between 1 and 4).options
is an object which defaults to {min:0, max: undefined}
. Note: this function takes into account surrogate pairs.['ar-DZ', 'ar-SA', 'ar-SY', 'cs-CZ', 'de-DE', 'da-DK', 'el-GR', 'en-AU', 'en-CA', 'en-GB', 'en-HK', 'en-IN', 'en-KE', 'en-NG', 'en-NZ', 'en-RW', 'en-UG', 'en-US', 'en-TZ', 'en-ZA', 'en-ZM', 'es-ES', 'en-PK', 'fa-IR', 'fi-FI', 'fr-FR', 'he-IL', 'hu-HU', 'it-IT', 'ja-JP', 'ko-KR', 'lt-LT', 'ms-MY', 'nb-NO', 'nn-NO', 'pl-PL', 'pt-PT', 'ro-RO', 'ru-RU', 'sr-RS', 'tr-TR', 'vi-VN', 'zh-CN', 'zh-HK', 'zh-TW']
OR 'any'. If 'any' is used, function will check if any of the locales match).[ 'AT','AU','BE','CA','CH','CZ','DE','DK','DZ','ES','FI','FR','GB','GR','IL','IN','IS','IT','JP','KE','LI','MX','NL','NO','PL','PT','RO','RU','SA','SE','TW','US','ZA','ZM' ]
OR 'any'. If 'any' is used, function will check if any of the locals match).options
is an object which defaults to { protocols: ['http','https','ftp'], require_tld: true, require_protocol: false, require_host: true, require_valid_protocol: true, allow_underscores: false, host_whitelist: false, host_blacklist: false, allow_trailing_dot: false, allow_protocol_relative_urls: false }
.matches('foo', /foo/i)
or matches('foo', 'foo', 'i')
.blacklist(input, '\\[\\]')
.<
, >
, &
, '
, "
and /
with HTML entities.<
, >
, &
, '
, "
and /
.options
is an object with the following keys and default values:
keep_new_lines
is true
, newline characters are preserved (\n
and \r
, hex 0xA
and 0xD
). Unicode-safe in JavaScript.'0'
, 'false'
and ''
returns true
. In strict mode only '1'
and 'true'
return true
.null
if the input is not a date.NaN
if the input is not a float.NaN
if the input is not an integer.whitelist(input, '\\[\\]')
.XSS sanitization was removed from the library in 2d5d6999.
For an alternative, have a look at Yahoo's xss-filters library or at DOMPurify.
$ npm test
Remember, validating can be troublesome sometimes. See A list of articles about programming assumptions commonly made that aren't true.
Copyright (c) 2017 Chris O'Hara <cohara87@gmail.com>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
String validation and sanitization
The npm package validator receives a total of 9,798,631 weekly downloads. As such, validator popularity was classified as popular.
We found that validator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
Security News
Members Hub is conducting large-scale campaigns to artificially boost Discord server metrics, undermining community trust and platform integrity.
Security News
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.