#611·phpdotenv

Validator::isBoolean() accepts whitespace-only values

Author: GrahamCampbellCreated Aug 24, 2026Updated Aug 24, 2026

Validator::isBoolean() accepts a whitespace-only value as valid, while an empty string is correctly rejected. filter_var() with FILTER_VALIDATE_BOOLEAN trims its input before matching, so a value that is only spaces or tabs carries no boolean but still passes.

php
// FLAG="   " in the environment
$dotenv->required('FLAG')->isBoolean();   // passes, but should not
// FLAG= (empty) correctly fails

Only whitespace-only values slip through; ' on ' still validates via the filter's own trimming, and a genuinely empty value already fails. The fix is to reject a value that is empty after trimming in isBoolean(), mirroring the existing empty-string guard.

This is a behaviour change, since whitespace-only values pass validation today and would start failing at boot. It belongs in the next major rather than a 5.x release.