if input_email in valid_emails_set:
send_email(input_email, another_param, etc)
How not to check the validity of an email address
31–40 of 243 posts
Re: How not to check the validity of an email address
#32this should be submitted to thedailywtf.com...
It's #1 on HN, it has plenty of exposure already.
Re: How not to check the validity of an email address
#33Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work.
Here's my own personal story. The other day, I had a brain fart regarding my password for my online banking account. So, I got lazy and just clicked the "forgot password" link, answered the security questions, and within seconds, I got an email. It had my old password in it. Yes, my bank stores passwords in clear text. sigh.
BTW, I'm also looking for a new job right now, so if you're after someone with 2 brain cells to rub together who also happens to be a decent Python programmer, shoot me an email. (It's in my profile.)
Re: How not to check the validity of an email address
#34You know what would be awesome?! If the developer in question happens to frequent HN and responds to this thread, eh?
Re: How not to check the validity of an email address
#35Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.
Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.
wooooow
Re: How not to check the validity of an email address
#36Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…
> Every single legacy application I've ever worked on has had analogous code buried in it somewhere.
I'm not old enough to be responsible for stuff like that but I am incompetent enough.
Re: How not to check the validity of an email address
#37if input_email in valid_emails_set: send_email(input_email, another_param, etc) Their solution, while isn't wrong, could still be improved. With a somewhat modified 2822 regex with a more strict domain rule. But I would also assume you could just query the db.
You assume "in valid_emails_set" doesn't make a query.
It's fairly trivial to define your own __contains__ in python.
Re: How not to check the validity of an email address
#38if input_email in valid_emails_set: send_email(input_email, another_param, etc) Their solution, while isn't wrong, could still be improved. With a somewhat modified 2822 regex with a more strict domain rule. But I would also assume you could just query the db.
I don't see how regular expression come in here. They'd have a list of valid addresses (in a Python dict or in a database or wherever) and they check against them.
Re: How not to check the validity of an email address
#39Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.
Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.
> mmariani 41 minutes ago | link
> Clearly you must be joking
No shit.
Re: How not to check the validity of an email address
#40Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails".
There is a whole other layer which is very good at handling incorrect or undeliverable addresses.