{"action":"created","issue":{"url":"https://api.github.com/repos/chriso/validator.js/issues/486","repository_url":"https://api.github.com/repos/chriso/validator.js","labels_url":"https://api.github.com/repos/chriso/validator.js/issues/486/labels{/name}","comments_url":"https://api.github.com/repos/chriso/validator.js/issues/486/comments","events_url":"https://api.github.com/repos/chriso/validator.js/issues/486/events","html_url":"https://github.com/chriso/validator.js/issues/486","id":131184692,"number":486,"title":"Passing an array containing an object with .toString set to a string will break all methods of validator.js","user":{"login":"kamagatos","id":1569859,"avatar_url":"https://avatars.githubusercontent.com/u/1569859?v=3","gravatar_id":"","url":"https://api.github.com/users/kamagatos","html_url":"https://github.com/kamagatos","followers_url":"https://api.github.com/users/kamagatos/followers","following_url":"https://api.github.com/users/kamagatos/following{/other_user}","gists_url":"https://api.github.com/users/kamagatos/gists{/gist_id}","starred_url":"https://api.github.com/users/kamagatos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kamagatos/subscriptions","organizations_url":"https://api.github.com/users/kamagatos/orgs","repos_url":"https://api.github.com/users/kamagatos/repos","events_url":"https://api.github.com/users/kamagatos/events{/privacy}","received_events_url":"https://api.github.com/users/kamagatos/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-02-03T23:08:08Z","updated_at":"2016-02-04T01:44:58Z","closed_at":"2016-02-04T01:44:58Z","body":"The following will break :\r\n```\r\nvar myObj = [{ toString: 'randomstring' }]\r\nvalidator.isURL(myObj)\r\n```\r\nThe reason is because calling [ `.toString()` here](https://github.com/chriso/validator.js/blob/master/validator.js#L132) will natively call `toString` on every index of the array and since in our case, `toString` isn't a function, it will simply throw an exception."},"comment":{"url":"https://api.github.com/repos/chriso/validator.js/issues/comments/179568354","html_url":"https://github.com/chriso/validator.js/issues/486#issuecomment-179568354","issue_url":"https://api.github.com/repos/chriso/validator.js/issues/486","id":179568354,"user":{"login":"chriso","id":364903,"avatar_url":"https://avatars.githubusercontent.com/u/364903?v=3","gravatar_id":"","url":"https://api.github.com/users/chriso","html_url":"https://github.com/chriso","followers_url":"https://api.github.com/users/chriso/followers","following_url":"https://api.github.com/users/chriso/following{/other_user}","gists_url":"https://api.github.com/users/chriso/gists{/gist_id}","starred_url":"https://api.github.com/users/chriso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chriso/subscriptions","organizations_url":"https://api.github.com/users/chriso/orgs","repos_url":"https://api.github.com/users/chriso/repos","events_url":"https://api.github.com/users/chriso/events{/privacy}","received_events_url":"https://api.github.com/users/chriso/received_events","type":"User","site_admin":false},"created_at":"2016-02-04T01:44:58Z","updated_at":"2016-02-04T01:44:58Z","body":"Yeah I'm inclined to say that guarding against this is outside the scope of the library. Messing with `toString()` causes the language built-ins (`Array.toString()`) to break - this is not a problem with this library but rather a problem with your input.\r\n\r\nThe following also breaks the library:\r\n\r\n```javascript\r\nvalidator.isEmail({toString: function () { throw new Error(); }});\r\n```\r\n\r\nWe obviously shouldn't have to guard against that. This is a string validation library.\r\n\r\nIf you want to check untrusted input then you could coerce it yourself:\r\n\r\n```javascript\r\ntry {\r\n  // coerce to a string\r\n  untrusted_input += '';\r\n} catch (err) {\r\n  // input is invalid\r\n}\r\n```"}}