Why does express-validator not detect missing fields when validating XML input?

Question

I have an express-based server that parses xml rather than json (using body-parser-xml).

I then use express-validator to validate the body input like this (the real code doesn't look quite like this, but this simplified example still triggers my issue):

router.post("/", 
    body('session.credential[0].$.username', 'Username').isString().trim().notEmpty(),
    (req, res) => { /* check validationResult() and then continue with business logic */ });

If I now send something like this to the server it works (it will generate an error because user is not the same as username):

<session>
    <credential user="" />
</session>

But if I instead send this it will not report any error:

<session>
    <credential />
</session>

What is wrong here?

Answer 1

Ok, it turns out this is a bug in version 7 of express-validator: https://github.com/express-validator/express-validator/issues/1245.

I downgraded to 6.15.0 and that fixed the problem.