YunoHost / issues

General issue tracker for the YunoHost project
72 stars 8 forks source link

email validation in config panel is too relax... #2058

Open jedie opened 2 years ago

jedie commented 2 years ago

The current EmailQuestion regex is just: r"^.+@.+"

This is not really strict, isn't it? You can pass email with spaces etc. Just a @ with some pre-/suffix will always match.

In my case i can crash the app, if i insert a invalid email :(

The django project validates with some really complex regex, see: https://github.com/django/django/blob/f3f9d03edf17ccfa17263c7efa0b1350d1ac9278/django/core/validators.py#L174-L195 and the email will be splitted between user- and domain-part...

thinktrans commented 2 years ago

If I may, I would like to request you to keep it as simple as this: <e-mail local part>@<domain name>

Which can be implemented as follows: For <e-mail local part> - Follow the guidelines by the "Universal Acceptance Steering Group" - UASG-026 - https://uasg.tech/download/uasg-028-considerations-for-naming-internationalized-email-mailboxes-en/

For <domain name>, you can follow any domain validation methodology using standard libraries, depending on your programming language. For the recent studies on the subject, follow the document UASG-018A - https://uasg.tech/download/uasg-018a-ua-compliance-of-some-programming-language-libraries-and-frameworks-en/.

alexAubin commented 2 years ago

Hmf yeah we didn't put the full mystical regex in there, is that such a big deal ... I'm not even sure just a regex would do the work, as maybe somebody will comeup with some edge case where root@localhost should be an accepted value (no dot in domain part) and then you end up having to write an entire bunch of advanced logic to cover super specific cases. And then somebody else will complain that domains with no valid MX are accepted ...

In the meantime, you can write your own custom validator, cf https://github.com/YunoHost/example_ynh/blob/master/scripts/config#L69