search

danielgtaylor / huma

Huma REST/HTTP API Framework for Golang with OpenAPI 3.1
https://huma.rocks/
MIT License
1.95k stars 144 forks source link

The validation of format:"email" is not perfect. #446

Closed minpeter closed 4 months ago

minpeter commented 4 months ago

Email string json:"email" doc:"Email of the user" format:"email"

Validation was added and tested as above. abc -> deny abc@ -> deny abc@a -> allow abc@a. -> deny acb@a.bc -> allow

Here I think it's strange that abc@a passes validation.

minpeter commented 4 months ago

Is this a valid email by rfc 5322?

I'm confused by the email verification standards that are different from usual.

lazharichir commented 4 months ago

These are indeed valid email addresses. You can use your own validation logic to further narrow down the emails you wish to accept.

See https://en.wikipedia.org/wiki/Email_address#Examples, specifically "admin@example"; or even https://stackoverflow.com/questions/20573488/why-does-html5-form-validation-allow-emails-without-a-dot for information.

ICANN banned dotless email address, but they do remain syntactically correct (e.g., user@localhost with localhost being a valid domain).

minpeter commented 4 months ago

Thank you very much