An array in the querystring can (by)pass the validation if the first element is correct, but useless when expecting a single value.

[darkman82]

Hi guys,

Let's suppose we had a GET like that http://localhost:3000/test?type=new&type=foo

// Ver 6.1.1
router.get('/',
    v.query('type').isIn(['new','renewal','upgrade'])
    function (req, res) {
        const errors = v.validationResult(req);
        if (!errors.isEmpty())
             return res.status(422).json({errors: errors.array()});
        return res.status(200).json(req.matchedData);
    }
);
// Result: {"type":["new","foo"]}
// Expected: Validation failure (or sanitization)

It seems that this isn't a desired behavior as this would force us to do a further sanitization in order to consume the single parameter instead of the array.
Is that correct?

Thank you

[gustavohenke]

Duplicate of #704

[darkman82]

As a workaround we had to use not().isArray() for all fields or sanitization, eg:

v.query('currency').optional().not().isArray().isIn(['EUR','GBP','USD'])
// toInt() it's enough for numeric values
v.query('months').isIn(['1','3','6','12']).toInt(),

[fedeci]

Also related to #791

[gustavohenke]

Hi hi, https://github.com/express-validator/express-validator/releases/tag/v7.0.0 is out with a fix for this 🙂

[darkman82]

Hi,
Upgraded to 7.0.0.

You can still by-pass the validation as long as ALL elements are correct: http://localhost:3000/test?type=new&type=new

// Ver 7.0.0
router.get('/',
    v.query('type').isIn(['new','renewal','upgrade'])
    function (req, res) {
        const errors = v.validationResult(req);
        if (!errors.isEmpty())
             return res.status(422).json({errors: errors.array()});
        return res.status(200).json(req.matchedData);
    }
);

// Result: {"type":["new","new"]}
// Expected: Validation failure

Workaround: v.query('type').not().isArray().isIn(['new','renewal','upgrade'])

Note:
The vast majority of cases in query string is related to single values, so this should be the default expecting behavior as those expecting an array, can use toArray() to transform single values into array.