I'm not an RFC purist nor expert, but I can't imagine that validating email addresses like <script>alert('t');</script>@toto.fr} is a good idea anyway :-)
So here's a revided regexp that prevent this kind of behavior:
Index: /Users/niko/www/symfonians/lib/symfony/validator/sfEmailValidator.class.php
===================================================================
--- /Users/niko/www/symfonians/lib/symfony/validator/sfEmailValidator.class.php (revision 7171)
+++ /Users/niko/www/symfonians/lib/symfony/validator/sfEmailValidator.class.php (working copy)
@@ -34,7 +34,7 @@
$strict = $this->getParameterHolder()->get('strict');
if ($strict == true)
{
- $re = '/^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i';
+ $re = '/^([a-zA-Z0-9_\.\-\+])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/';
}
else
{
Also, the problem remains with strict email validation set to false. I don't have a solution for the big Cal Henderson regexp :-(
