Sanitization before validators are run can cause validation to fail

In the legacy API of v4, validators are only run when you try to get the errors/validation result. This is in contrast with previous versions, where validators ran as soon as they were defined.

Because of this, if sanitizers are defined before validators run, some of them could change the input and make the validation fail. This is a regression introduced in v4.

Example from chriso/validator.js#727:

req.checkBody('date_of_birth', 'Date of Birth has invalid date').optional({checkFalsy: true}).isISO8601();
req.sanitize('date_of_birth').toDate();

var errors = req.validationErrors();
// date_of_birth will have failed, because validators ran with a Date object, and not with a string

[gustavohenke]

Fix in with v5.1.2!

[gustavohenke]

Okay, so I analyzed this a bit and came to a conclusion that this is an issue of toDate sanitizer combined with isISO8601 validator, exclusively.

All values are already being coerced into strings for the standard validators, with some special rules followed:

• null/undefined/NaN become '';
• Arrays have their first value only stringified.

This solves it for pretty much all other validators/sanitizers.

I think Date objects should have a special rule as well, one that calls its .toISOString() method, so that it works with the previous method.

P.S.: If you have a different data sample that is broken, please let me know by commenting on this issue!