z.string().url() should reject invalid schemes like https://https://example.com #4406

HiroTonaka · 2025-05-19T03:09:10Z

Currently, z.string().url() does not catch malformed URLs such as https://https://example.com.
These are technically invalid, but they still pass validation.

To work around this, I had to use a custom refine() with a URL parser and an additional scheme check.

Here's the custom validation I implemented:

const isValidUrl = (url: string): boolean => {
  const schemeMatches = url.match(/https?:\/\//g);
  if (schemeMatches && schemeMatches.length > 1) return false;

  try {
    new URL(url);
    return true;
  } catch {
    return false;
  }
};

const noticeUrlSchema = z
  .string()
  .trim()
  .refine(url => isValidUrl(url), {
    message: 'Invalid URL format',
  })
  .optional();

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

z.string().url() should reject invalid schemes like https://https://example.com #4406

z.string().url() should reject invalid schemes like https://https://example.com #4406

z.string().url() should reject invalid schemes like https://https://example.com #4406

z.string().url() should reject invalid schemes like https://https://example.com #4406

Comments