search

adonisjs / validator

Schema based validator for AdonisJS
MIT License
115 stars 40 forks source link

Forcing request.validate() to run only for body #179

Closed blueberry6401 closed 9 months ago

blueberry6401 commented 9 months ago

I think maybe this is a bug, or can lead to serious issues about handling user's input; or it's just me using it wrong.

Currently if I use request.validate(), it will merge the query params and body to validate; while our app uses only request.body() to get inputs from users. So if the request.body() contains invalid data, and user tricks the app with correct query params, it will pass the validation.

Is this a bug or it suppose to do this?

blueberry6401 commented 9 months ago

Never mind, the validate function returns validated data. I should use it.