BUG: zod zccepts invalid url: z.string().url().safeParse("a:")

[valerii15298]

Current behaviour:

// zod 3.21.4
console.log(z.string().url().safeParse("a:")); // {success: true}

I expect validation to fail there

[JaneJeon]

It's because the URL is being validated with just a new URL(): https://github.com/colinhacks/zod/blob/master/src/types.ts#L757

Probably should add checks to make sure only certain protocols (http/https?) get through, and that it has a valid, non-empty host (or just use validator.js refinement)

[valerii15298]

@JaneJeon yeah... does not seem right to me using native URL class... I would choose validator.js for url validation really. Because with URL class we do not have any flexibility... For example class-validator uses validator.js url validation too.
I guess this is related: #120 (comment)
@colinhacks
is there a place for negotiating url validation or what would be workarounds for that if I wanna validate http urls? Should I use refine for it or maybe there is a better solution?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[JaneJeon]

Still unaddressed

[JacobWeisenburger]

Is this what you are looking for?

const schema = z.string().startsWith( 'http' ).url()
console.log( schema.safeParse( 'a:' ).success ) // false
console.log( schema.safeParse( 'http:a' ).success ) // true

If you found my answer satisfactory, please consider supporting me. Even a small amount is greatly appreciated. Thanks friend! 🙏
https://github.com/sponsors/JacobWeisenburger