fix(isSlug): restrict allowed characters to valid slug charset#2693
Conversation
The isSlug regex was inconsistent - it used [^\s]* in the middle which allowed any non-whitespace character (dots, asterisks, ampersands, etc.) while only restricting the 2nd character to [a-z0-9-\\]. This caused: - i.am.not.a.slug -> false (dot at position 2 caught) - slug.is.cool -> true (dot at position 4+ not caught) The new regex only allows lowercase alphanumeric characters, hyphens, and underscores - consistent with what slug generators produce. Also moved test cases containing * and & from valid to invalid, since these are not valid slug characters. Fixes validatorjs#2383
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2693 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 114 114
Lines 2595 2595
Branches 659 659
=========================================
Hits 2595 2595 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR fixes inconsistent isSlug validation by tightening the regex so only lowercase alphanumerics plus -/_ are allowed throughout the slug, aligning behavior with the documented/expected “slug charset”.
Changes:
- Replaced the
isSlugregex to consistently reject dots and other special characters beyond position 2. - Updated
isSlugunit tests to add coverage for short slugs and to move special-character cases from valid → invalid.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/lib/isSlug.js |
Updates the core isSlug regex to restrict the allowed character set. |
test/validators.test.js |
Updates test vectors for isSlug, adding new valid cases and ensuring dots/special chars are rejected. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Fixes #2383 — Inconsistent isSlug results with dots and special characters.
The isSlug regex used
[^\s]*in the middle which allowed any non-whitespacecharacter (dots,
*,&, etc.) while only restricting the 2nd character.This caused inconsistent behavior:
isSlug('i.am.not.a.slug')→false✗ (dot at position 2 caught)isSlug('slug.is.cool')→true✗ (dot at position 4+ not caught)Fix: Replaced the regex with
/^[a-z0-9](?!.*[-_]{2,})(?:[a-z0-9-_]*[a-z0-9])?$/which consistently allows only lowercase alphanumeric chars, hyphens, and underscores.
References:
Checklist