FR: Validate postal code

[mimi89999]

Hello,

Recently I found a certificate with an invalid postal code: https://crt.sh/?id=6811189993&opt=zlint

It was found due to the field length exceeding 17 chars. However, if the value in that field was shorter, but still invalid, the certificate would not have been found

I think that Zlint should check if the postal code matches a template/regex for the country. A list of postal code templates can be found on https://en.m.wikipedia.org/wiki/List_of_postal_codes

[zakird]

Is this formalized in any standard or baseline requirements? We might be able to add a community-based INFO or WARN lint, but I suspect not a hard error without something like that.

[christopher-henderson]

@zakird that's precisely what I was thinking at first. I balk at the idea of maintaining a list of postal codes as I'm not sure if there is any authority on such a list. I might give something naive a shot and see what shows up in the test corpus. If it's an ocean of postal codes that aren't listed in non-authoritative sources (wiki) then I reckon we might not want to enforce what we don't know.

[mimi89999]

Is this formalized in any standard or baseline requirements?

No, but it might be declared in a formal way by the national post of each country.

[mimi89999]

I'm not sure if there is any authority on such a list

For Poland, there is the list maintained by Poczta Polska: https://www.poczta-polska.pl/hermes/uploads/2013/11/spispna.pdf

[cardonator]

I agree that this would be extremely rough for a project like zlint to manage. I can see the benefits of doing so (even for CSL information as well), but it's a massive undertaking that there are entire industries built around that doesn't seem to make much sense in this project.

[mimi89999]

I think that Zlint shouldn't keep entire lists of postal codes for each country, but just templates like xx-xxx. This should be easier.

Maybe it would be worth trying the templates from Wikipedia on a large number of certificates downloaded from CT logs.