isURL validates true to '[email protected]'

[Arsikod]

console.log(validator.isURL("[email protected]")) returns true.
But it is not a valid url.

[heanzyzabala]

Hi @profnandaa & @Arsikod,

I checked the code. It seems like we have to modify the logic in line: 96

validator.js/src/lib/isURL.js

Lines 90 to 99 in f67a57f

	split = url.split('@');
	if (split.length > 1) {
	if (options.disallow_auth) {
	return false;
	}
	auth = split.shift();
	if (auth.indexOf(':') >= 0 && auth.split(':').length > 2) {
	return false;
	}
	}

The implementation fails to check if the url is in basic auth form without password, that looks like this:

http://user:@www.foobar.com/

For the fix, we just have to check if it's in the right form.

   if (auth.indexOf(':') === -1 || (auth.indexOf(':') >= 0 && auth.split(':').length > 2)) { 
     return false; 
   } 

This way, [email protected] will pass the condition and return false.

I'll submit a PR if you guys agree with the change. Thanks!

[anay-kava]

+1 - this is a serious issue.
Just checking if the fix would be included in the official release soon?

[tux-tn]

@anay-kava feel free to submit a PR concerning this issue

[heanzyzabala]

Hi. Please see #1425.

[profnandaa]

closed in #1425