search

Infinite-Chess / infinitechess.org

Infinite Chess Web Server
https://www.infinitechess.org
GNU Affero General Public License v3.0
192 stars 45 forks source link

Incorrect email regex #16

Closed jermOSS closed 4 months ago

jermOSS commented 4 months ago

This regex is incorrect.

https://github.com/Infinite-Chess/infinitechess.org/blob/52fb1674a87dd2eb0aaf9dc9e6814ce91dba7258/controllers/createaccountController.js#L217

Emails can contain more characters than just numbers, letters, dots and underscores.

Validating emails using regex is incorrect. Emails have very complex specification of how can they be composed. It is almost impossible to match all cases. This needs a better solution.

Nul-led commented 4 months ago

You can send a cheap ICMP to the SMTP server after they have successfully bypassed the regex. Once they pass this we can actually send an email with the verification link.

Naviary2 commented 4 months ago

You can send a cheap ICMP to the SMTP server after they have successfully bypassed the regex. Once they pass this we can actually send an email with the verification link.

This seems like a great idea to avoid sending emails to invalid or non-existent email accounts. Can you create a separate issue from this? I am going to be closing this one.