mail-in-a-box / mailinabox

Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box.
https://mailinabox.email/
Creative Commons Zero v1.0 Universal
13.88k stars 1.43k forks source link

email should be valid? #1465

Open wis opened 5 years ago

wis commented 5 years ago

I see you're using your own (python) implementation of the spec for email validation.

JoshData commented 5 years ago

There are some other constraints on usernames:

https://github.com/mail-in-a-box/mailinabox/blob/master/management/mailconfig.py#L40

For mail users (i.e. logins), you can only use lowercase letters, numbers, underscore, dash, and @. After setup you can create an alias that doesn't have these constraints.

We should add ^ to the error message during setup.

wis commented 5 years ago

thanks for the reply. this is unfortunate, using this address is my main reason to having a private email server, it's short, memorable, it almost looks like a @handle, and the (non arbitrary) tilda, which's a hacker's reference to unix's shorthand for the home directory. I really hope this gets fixed soon. for now i'm testing with -@wis.am, and it seems that there are more issues, with sending and receiving mail from such short and non-alphanumeric addresses.. receiving

Address not found
Your message wasn't delivered to -@wis.am because the address couldn't be found, or is unable to receive mail.
The response from the remote server was: 501 5.1.3 Bad recipient address syntax

sending

An error occurred!
SMTP Error (501): Failed to set sender "-@wis.am" (5.1.7 Bad sender address syntax).
zatricky commented 5 years ago

Seems this is a security limitation from Postfix: https://serverfault.com/questions/893648/postfix-bad-recipient-address-syntax-email-starting-with-dash-hyphen

It's a pity* - but at least it is easy for you to "fix" locally if you want to ignore the security concern. The related concern is with deliverability. If you do so, likely other postfix systems won't be able to send mails to you.

The other bit is that the regex should probably be updated to disallow the hyphen as the first character.

*- RFC5322 does seem to allow for -@<domain>

JoshData commented 5 years ago

So, this limitation just applies to creating a mail user -- the email address you use to log in to check your mail. You can create an alias, after setup finishes, to create any valid email address that forwards to your mail user. You can send/receive email as the alias --- meaning, you can have any email address you want. You'll just log in to check your email with a different address.

wis commented 5 years ago

oh, got it, thanks for making it clear. it works, I have that nice email now. I had to change my (the sender's) email by modifiying my identity, by clicking "Identities" hyperlink next to the "From" option in the email composition UI and changing the email to the alias' email.

tdulcet commented 5 years ago

The other bit is that the regex should probably be updated

In #1456, I added a check to verify that the hostname is a valid fully qualified domain name (FQDN).

The following Bash code would perform a similar check for the e-mail address:

RE1='^.{6,254}$'
RE2='^.{1,64}@'
RE3='^[[:alnum:]!#\$%&'\''\*\+/=?^_\`{|}~-]+(\.[[:alnum:]!#\$%&'\''\*\+/=?^_\`{|}~-]+)*@([[:alnum:]][[:alnum:]\-]{0,61}[[:alnum:]]\.)+[:alpha:]{2,63}$'
if ! [[ $EMAIL_ADDR =~ $RE1 && $EMAIL_ADDR =~ $RE2 && $EMAIL_ADDR =~ $RE3 ]]; then
    echo "Error: E-mail address is not valid." >&2
    exit 1
fi

These regular repressions were adapted from here (bottom of page) and should except all valid e-mail addresses (including the tilda and hyphen), except those with Unicode characters.

If you need to disallow forward slashes and uppercase letters then replace RE3 with this:

RE3='^[[:lower:][:digit:]!#\$%&'\''\*\+=?^_\`{|}~-]+(\.[[:lower:][:digit:]!#\$%&'\''\*\+=?^_\`{|}~-]+)*@([[:lower:][:digit:]][[:lower:][:digit:]\-]{0,61}[[:lower:][:digit:]]\.)+[:lower:]{2,63}$'

If needed, I could add this to my #1456 pull request.