Skip to content

feat(isBase64): improve base64 validation based on RFC4648 #2491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 26, 2025

Conversation

aseyfpour
Copy link
Contributor

Add padding to the options list.
Update regexes to support validation with and without padding.
Update default options to maintain backward compatibility.
Add new tests to cover various scenarios.

In the previous version, only Base64 strings with padding and URL-safe Base64 strings without padding were validated. However, according to RFC4648, both standard and URL-safe Base64 variants can be valid with or without padding. Therefore, this version supports four validation combinations—standard with padding, standard without padding, URL-safe with padding, and URL-safe without padding—while maintaining backward compatibility.

Checklist

  • PR contains only changes related; no stray files, etc.
  • README updated (where applicable)
  • Tests written (where applicable)
  • References provided in PR (where applicable)

add padding to the option list
update regexes to support validation with/without padding
update default options to keep the changes backward compatible
add new test to cover different scenarios
Copy link
Member

@WikiRik WikiRik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the quick updates. I'll need to take some more time for a proper review, but on initial look this should be good so I'll request some additional reviewers already

@aseyfpour
Copy link
Contributor Author

@rubiin @WikiRik

It’s been a month since the last changes. I’d appreciate it if you could involve another reviewer for this PR.

@rubiin rubiin requested review from profnandaa and a team and removed request for a team December 2, 2024 14:42
@aseyfpour aseyfpour requested a review from WikiRik December 6, 2024 23:35
@aseyfpour
Copy link
Contributor Author

UP

@WikiRik WikiRik merged commit 7ff247d into validatorjs:master Mar 26, 2025
10 checks passed
@mykhailo-klym
Copy link

Just a heads up this caused a stack overflow issue in our app.

  • The issue seems to be from regex.test.
  • The string that we test is around 26MB
  • Unfortunately I cannot provide you with a string or reproducible scenario, because my string can contain sensitive data.
  • Previous version is working just fine, e.g. no stack overflow issues.

... Sorry, if I can create a reproducible scenario I will open an issue.

@alumni
Copy link

alumni commented Jul 8, 2025

The regular expression used here can cause a ReDoS on large strings.

The old implementation was more efficient because the iteration was handled by JS, not by the RegEx.

@WikiRik
Copy link
Member

WikiRik commented Jul 8, 2025

Feel free to open a new PR with an improved version

KrayzeeKev pushed a commit to KrayzeeKev/validator.js that referenced this pull request Jul 14, 2025
KrayzeeKev pushed a commit to KrayzeeKev/validator.js that referenced this pull request Jul 14, 2025
@KrayzeeKev
Copy link

I've created #2574 to resolve the stack overflow issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants