egulias / EmailValidator

PHP Email address validator
MIT License
11.45k stars 210 forks source link

Validation permits NUL bytes #372

Open TheAndrey opened 1 year ago

TheAndrey commented 1 year ago

I accidentally discovered that the validation rules allow NUL bytes in the email address login.

As a result, I get an error from an SMTP server that doesn't like this address.

# exim4
501 NUL characters are not allowed in SMTP commands

# mailpit
451 4.3.5 Unable to process mail
[smtpd] error parsing message: malformed MIME header line: Received: from [127.0.0.1]

Code example

<?php

use Egulias\EmailValidator\EmailValidator;
use Egulias\EmailValidator\Validation\MultipleValidationWithAnd;
use Egulias\EmailValidator\Validation\NoRFCWarningsValidation;
use Egulias\EmailValidator\Validation\RFCValidation;

require_once './vendor/autoload.php';

$validator = new EmailValidator();
$rules = new MultipleValidationWithAnd([
    new RFCValidation(),
    new NoRFCWarningsValidation(),
]);

var_dump($validator->isValid(urldecode('exa%00mple%40domain.tld'), $rules)); // bool(true)
egulias commented 1 year ago

Hey @TheAndrey Thanks for reporting. Will take a look into it.