go-playground / validator

:100:Go Struct and Field validation, including Cross Field, Cross Struct, Map, Slice and Array diving
MIT License
16.41k stars 1.3k forks source link

Url validation accepts `https:` as valid url. #1112

Closed nagdar7 closed 1 year ago

nagdar7 commented 1 year ago

Package version eg. v9, v10:

v10

Issue, Question or Enhancement:

Url validation accepts https: as valid url.

Code sample, to showcase or reproduce:

package main

import (
    "fmt"

    "github.com/go-playground/validator/v10"
)

type User struct {
    Url string `json:"url" validate:"required,url"`
}

func main() {
    validate := validator.New()
    user := &User{Url: "https:"}
    err := validate.Struct(user)
    if err != nil {
        panic(err)
    }
    fmt.Println("ok")
}

This code results in ok print, but expected result should be panic on error

Ivaka commented 1 year ago

It appears the url is a more relaxed URL validation, maybe you should use http_url to ensure that the url is actually an http(s) url. Using http_url will still not address the issue, as the validation code itself currently allows http: or http://. I've prepared a PR that addresses this here.