npm install [email protected]
node poc.js

const validator = require('validator');

// Cadena "test" normal - rechazada correctamente
console.log(`Is "test" (String.length: ${'test'.length}) length ≤ 3? ${validator.isLength('test', { max: 3 })}`);
// Output: Is "test" (String.length: 4) length ≤ 3? false

// Cadena "test" normal - aceptada correctamente
console.log(`Is "test" (String.length: ${'test'.length}) length ≤ 4? ${validator.isLength('test', { max: 4 })}`);
// Output: Is "test" (String.length: 4) length ≤ 4? true

// "test" con 4 selectores de variación - aceptada INCORRECTAMENTE
console.log(`Is "test️️️️" (String.length: ${'test\uFE0F\uFE0F\uFE0F\uFE0F'.length}) length ≤ 4? ${validator.isLength('test\uFE0F\uFE0F\uFE0F\uFE0F', { max: 4 })}`);
// Output: Is "test️️️️" (String.length: 8) length ≤ 4? true ⚠️ VULNERABLE!

Is "test" (String.length: 4) length less than or equal to 3? false
Is "test" (String.length: 4) length less than or equal to 4? true
Is "test️️️️" (String.length: 8) length less than or equal to 4? true

const MAX_COMMENT_LENGTH = 100;

function validateComment(comment) {
  return validator.isLength(comment, { max: MAX_COMMENT_LENGTH });
}

const maliciousInput = 'a'.repeat(50) + '\uFE0F'.repeat(100);
// Longitud real: 150 caracteres
// validator.isLength() devuelve incorrectamente: true ❌
// La base de datos acepta la carga maliciosa ⚠️

npm install [email protected]

function safeIsLength(str, options = {}) {
  // Elimina los selectores de variación Unicode antes de la validación
  const cleanStr = str.replace(/[\uFE0E\uFE0F]/g, '');
  return validator.isLength(cleanStr, options);
}

npm audit --audit-level=high