how to validate form element names grouped as array?

[shebinleo]

form(action='/', method='POST')
input(name='company[name]', type='text')
input(name='company[description]', type='text')
input(name='company[address]', type='text')
input(type='submit')

For the above form how can I use the express-validator?

req.assert('company[name]', 'Company Name is required').notEmpty(); doesn't seems to work

[ctavan]

What framework are you using to create the forms? Can you provide a more complete example?

[shebinleo]

I am not using any framework to create forms. Simply using the jade.

If I put 'name' as the name of the textfield I can access the field and validate it
input(name='name', type='text')

But for 'company[name]' as the name I couldn't validate
input(name='company[name]', type='text')

[ctavan]

express-validator uses the req.param() method internally to extract parameters which again looks up the requested parameter in req.params, req.query and req.body. Maybe you can try to dump these 3 properties, to see how your variable is called?

[niftylettuce]

I'm experiencing this issue too... What is the workaround?

e.g. you can't do req.sanitize('object.property') ... and you can't do req.sanitize(req.query.object.property)

[niftylettuce]

Manually doing this is simple enough... but we should support the above.

var myProperty = req.query.myObject.myProperty;
if(myProperty !== 'undefined' && myProperty === 'true') {
  myProperty = true;
} else {
  myProperty = false;
}

[dhruv-bhatia]

I'm also having this problem and looking for a solution.

Dumping req.query gives me this:

{ company: 
   { name: 'Apple',
     description: 'We make Macs.',
     address: 'California' } }

However, there is no way to actually access the name, description, or address query fields with express-validator.

It would be great to have query array support!

[niftylettuce]

in meantime you can use validator and do var v = new Validator(); then do something similar like...

var Validator = require('validator').Validator;
var v = new Validator();
v.error = function(msg) {
    console.log('Fail');
}
v.check('abc').isInt(); //'Fail'

per examples on https://github.com/chriso/node-validator

[niftylettuce]

e.g. v.check(req.query.param1.param2.param3).isEmail();

edit: you might need to do var myForm = req.param('myFormArrayGroup'); and then replace req.query stuff with v.check(myForm.blah).... likewise when you sanitize, you would do myForm = sanitize(myForm.blah).xss();

[niftylettuce]

see edit to previous comment btw

[ctavan]

Ok, I see. Express is using node-querystring instead of the node-internal querystring. The difference is deep-deserialization of form data:

var querystring = require('querystring');
var qs = require('qs');
var string = 'foo[bar]=baz'
querystring.parse(string);
// -> { 'foo[bar]': 'baz' }
qs.parse(string);
// -> { foo: { bar: 'baz' } }

Seems like we have to put some effort into express-validator to support nested bodies....

We should probably write a .getParam() method, that accepts keys like .getParam('foo.bar') or .getParam('foo[bar]')

I'd be more than happy to apply a corresponding patch if anybody is willing to write one. I won't be able to do that during the next two weeks however myself... Apologies!

[dall]

@ctavan Did you fixed this issue?

Thank you so much!

[ctavan]

Sorry, I'm quite busy these days. Anyone willing to write a patch? I'm happy to accept pull requests.

[orfaust]

I've just committed a solution on my pull-request
#7 (comment)
Anoyone for a test? My debug cases might not be enough

[turbyho]

  req.check = function(param, fail_msg) {
    if(this.param(param) === undefined) {
        return validator.check(param, fail_msg);
    } else {
        return validator.check(this.param(param), fail_msg);
    }   
  };

with this small hack you can validate arays:

for input: name[first]

req.assert(req.body.name.first, 'No first name.').notEmpty();
req.check(req.body.name.first).noEmpty();

for input: email

req.assert(req.body.email, 'No email.').notEmpty();
req.check(req.body.email).noEmpty();

or

req.assert('email', 'No email.').notEmpty();
req.check('email').noEmpty();

[ctavan]

Can you check, if #8 (which contains #7) provides a solution to your problems?

[orfaust]

@turbyho I'm going to check that asap

[orfaust]

Your hack would work in a percfect world ;)
In a malicious scenario, the client may not post data as it should be, i.e. req.body.name could be undefined
In that case the server would throw an exception:

// req.check(req.body.name.first).notEmpty();

TypeError: Cannot read property 'first' of undefined

Also, since you don't send the parameter(s) name, but the value directly, this enhancement wouldn't work anymore

[turbyho]

when using property, you have the "problem" anywhere. the node-validator can use property and have the same "problem".

var check = require('validator').check
check(xxx.yyy.zzz).notEmpty();

yes, here is classic solution for perfect world :-)

var check = require('validator').check

try {
    check(xxx.yyy.zzz).notEmpty();
    check(yyy.zzz.aaa).notEmpty();
}
catch(err) {
    console.log(err);
}

[sharonjl]

Is this still an issue now?

[orfaust]

#7 (comment)

[sharonjl]

Yeah, that is what I thought. I added dot notation support as well.

a2fa8df

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.