Required validator differs from MVC validation in allowing bypass by using spaces in value.

[RyanONeill1970]

Using a 'required' validator such as below, I'm able to get past the validation by just entering a space (or multiple spaces).

This differs from the default jQuery MVC + Unobtrusive behaviour where spaces are treated as an empty string and fail validation.

<input data-val="true" data-val-required="Field cannot be blank." id="FieldName" name="FieldName" type="text" />

I think it is this line;

  return Boolean(value);

Which could be reworked as;

  return Boolean(value?.trim());

Link to source;

https://github.com/haacked/aspnet-client-validation/blob/062c8433f6c696bc41cd5d6811c840905c63bc9c/src/index.ts#L151C1-L151C31

I can do a pull request if you agree that it's correct.

Thanks both of you for your work on this.

Ryan

[dahlbyk]

Interesting. Between https://github.com/aspnet/jquery-validation-unobtrusive/blob/ceb212d6ea6ca4ea0fdaba1ccd4f8fa62645fff9/src/jquery.validate.unobtrusive.js#L384-L389 and https://github.com/jquery-validation/jquery-validation/blob/569e62234c321f4da30015f516f09c367c09a804/src/core.js#L1419-L1435 I can't find where it would be treating whitespace as not satisfying required. 🤔

[haacked]

What is the behavior of RequiredAttribute on the server. I think we’d want to match that.

[RyanONeill1970]

I'll just check it now and get back to you soon.

[RyanONeill1970]

Confirmed that server side MVC validation will reject a value consisting of just spaces. I have a small repro if you want me to push it to GitHub.

[haacked]

Yeah, I think our client side should match that behavior.

[haacked]

We'll accept a PR to address this.

[RyanONeill1970]

Simple patch I think, the only thing that worries me is that I've not done a unit or integration test. Manually testing all the way.

I'm happy to look into this in future, guided by yourselves (what lib, approach etc.).