Conversation

It's been [0] days since a website rejected a valid email address because their web devs only know about .com/.co.uk addresses. Congrats

@mediUKLtd

Diego Elio Pettenò

@flameeyes

Jun 17, 2021

validemail: { name: "Validemail", type: "regex", regex: "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,4}", message: oFlow.i18n.DD_FORM_VALIDATION_VALIDEMAIL }, Yeah. No.

Diego Elio Pettenò

@flameeyes

Jun 17, 2021

It's a whole bloody eShop platform that fails these! bugs.oxid-esales.com/view.php?id=65 IT WAS REPORTED IN 2016!

what the actual! You know for five years that you're rejecting people's email addresses as invalid because of a lazy regular expression! I wrote about this _twelve_ years ago!

flameeyes.blog

What’s a valid email address?

In my daily job (which actually was a weekend job, but that’s beside the point now), I’ve recently had to extend a regular expression that is used for validating a string as an email address. It ma…

Diego Elio Pettenò

@flameeyes

Jun 17, 2021

Wait, this was also _fixed_ five years ago! github.com/OXID-eSales/fl Is

@mediUKLtd

running a >5 years old web app???

github.com

Bug: 0006524 The regex for email validation by preethi-sivasankaran · Pull Request #68 · OXID-eSa...

The new Regex is similar to the one used in Azure theme. With the fix, the email validation is done mainly in PHP using the class MailValidator as used in Azure theme.

Replying to

and

I love this patch, but the new regex is still wrong. It rejects ppl who spend tens of thousands of dollars on their own TLD for an address with no dots in it.

Replying to

and

I mean there's no freaking way to validate an email address with a regex. So just give up?

Replying to

and

.+@.+ is the only legitimate regex for email address.

Replying to

and

It makes no sense to use a regex though, because you can use a type=email input in a web page and check it with the library you use to send emails before saving it. Proper input field and `new InternetAddress(email).validate();` is all that attestation.app does with it.

attestation.app

Device integrity monitoring

Hardware-based remote attestation service for monitoring the security of Android devices using the Auditor app.

Replying to

and

As it turns out *that* is the library they were using to do the browser-side validation. The backend didn't do any validation and let me register just fine after that.

Replying to

and

Jakarta Mail is the library we use for AttestationServer and even that doesn't bother checking all the validity rules. jakarta.ee/specifications It checks enough though, and doesn't wrongly reject something like a@a as invalid. It avoids causing harm, which is what matters.

11:32 PM · Jun 17, 2021Twitter Web App

Replying to

and

You'd be surprised how many programmers try to be smart and are not. Sigh.

Replying to

and

Meanwhile, even Internet Explorer 10 has type=email support: caniuse.com/input-email-te It's ridiculous to use anything more than that since it works perfectly well and gives nice errors with the standard UI. I go out of the way to use caniuse.com/constraint-val to match that UI too.

Show replies