Development

#2153 (sfEmailValidator accepts invalid emails in strict mode)

You must first sign up to be able to contribute.

Ticket #2153 (reopened defect)

Opened 1 year ago

Last modified 5 months ago

sfEmailValidator accepts invalid emails in strict mode

Reported by: Sapheriel Assigned to: fabien
Priority: minor Milestone:
Component: validation Version: 1.0.6
Keywords: email,strict,validation Cc:
Qualification: Unreviewed

Description

In strict mode sfEmailValidator accepts email addresses that are clearly faulty, such as "!#$%&*()\\/?~[]{@example.com", which are refused strict mode is disabled. Source of the problem is the regular expression used in strict mode:

"/^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i"

As you can see, it accepts every string in front of the main "@" that does not contain the "@" character or whitespace characters.

A possible solution would be to replace the first half of the strict mode regex with the first half of Henderson's extended regex which is used if strict mode is disabled.

Change History

01/04/08 17:30:57 changed by achedeuzot

  • qualification set to Unreviewed.

Hello,

There's a really nice validation code that was in a Linux Journal a few months ago.
Here's the code.

function CheckEmailStruct($email)

{

	$isValid = true;

	$atIndex = strrpos($email, "@");

	if (is_bool($atIndex) && !$atIndex)

	{

		$isValid = false;

	}

	else

	{

		$domain = substr($email, $atIndex+1);

		$local = substr($email, 0, $atIndex);

		$localLen = strlen($local);

		$domainLen = strlen($domain);

		if ($localLen < 1 || $localLen > 64)

		{

			// local part length exceeded

			$isValid = false;

		}

		else if ($domainLen < 1 || $domainLen > 255)

		{

			// domain part length exceeded

			$isValid = false;

		}

		else if ($local[0] == '.' || $local[$localLen-1] == '.')

		{

			// local part starts or ends with '.'

			$isValid = false;

		}

		else if (preg_match('/\\.\\./', $local))

		{

			// local part has two consecutive dots

			$isValid = false;

		}

		else if (!preg_match('/^[A-Za-z0-9\\-\\.]+$/', $domain))

		{

			// character not valid in domain part

			$isValid = false;

		}

		else if (preg_match('/\\.\\./', $domain))

		{

			// domain part has two consecutive dots

			$isValid = false;

		}

		else if (!preg_match('/^(\\\\.|[A-Za-z0-9!#%&`_=\\/$\'*+?^{}|~.-])+$/',

		str_replace("\\\\","",$local)))

		{

			// character not valid in local part unless

			// local part is quoted

			if (!preg_match('/^"(\\\\"|[^"])+"$/',

			str_replace("\\\\","",$local)))

			{

				$isValid = false;

			}

		}

		if ($isValid && !(checkdnsrr($domain,"MX") || checkdnsrr($domain,"A") || checkdnsrr($domain,"CNAME")))

		{

			// domain not found in DNS

			$isValid = false;

		}

	}

	return $isValid;

}

//and additionnal function for Windows Servers
if (!function_exists('checkdnsrr')) { //patch for windows OS servers, used in mail verification

	function checkdnsrr($host, $type = '') {

		if(!empty($host)) {

			if($type == '') $type = "MX";

			@exec("nslookup -type=$type $host", $output);

			while(list($k, $line) = each($output)) {

				if(eregi("^$host", $line)) {

					return true;

				}

			}

			return false;

		}

	}

}

I hope this can help to make a better sfEmailValidator function. achedeuzot

05/07/08 11:55:21 changed by noel

  • status changed from new to closed.
  • resolution set to fixed.

in r8831 and r8833

05/07/08 11:56:18 changed by noel

  • milestone set to 1.0.15.

05/07/08 17:48:31 changed by subzero2000

  • status changed from closed to reopened.
  • resolution deleted.

Re-opening ticket as regexes used as fixes are too restrictive.

Please review RFC 2822 as a source of characters legal in the local part of an email address. The regexes that were added as fixes are way too restrictive, and should be replaced with regexes that conform to RFC 2822. The regexes that were originally there were probably based on RFC 822, which has since been superceded by RFC 2822, although even the original regexes would not permit quoted whitespace, which is legal by RFC 822 and RFC 2822.

http://en.wikipedia.org/wiki/E-mail_address provides easy to read information showing what characters are legal in the local part of an email address, along with links to relevant RFCs.

05/07/08 18:50:28 changed by nicolas

(In [8835]) reverted r8833 (refs #2153)

05/07/08 18:56:21 changed by fabien

reverted in r8838

05/08/08 13:54:54 changed by fabien

  • milestone deleted.