FYI fix for empty string not being validated with sometimes|size:3

[macropay-solutions]

We just had a production incident about this BUG. Empty string is not validated.

'currency' => 'sometimes|size:3|in:EUR,USD',

    protected function isValidatable($rule, $attribute, $value)
    {
        if (in_array($rule, $this->excludeRules)) {
            return true;
        }

        return $this->presentOrRuleIsImplicit($rule, $attribute, $value) && // this returns false

    protected function presentOrRuleIsImplicit($rule, $attribute, $value)
    {
        if (is_string($value) && trim($value) === '') {
            return $this->isImplicit($rule); // returns from here false 
        }

        return $this->validatePresent($attribute, $value) ||
               $this->isImplicit($rule);
    }

The field should be validated only when present so this is clearly a bug.

Asking for the user to specify that it must be required via 'sometimes|required|size:3|in:EUR,USD' is nonsence since the size and the in rules should be applied.

We are thinking of removing $this->presentOrRuleIsImplicit($rule, $attribute, $value) call to fix this by overwriting the validator because we have it overwritten for the latest security bug anyway.

Update
or just remove this code

        if (is_string($value) && trim($value) === '') {
            return $this->isImplicit($rule);
        }

Originally posted by @macropay-solutions in #41734