Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

401–405 of 405 posts

Re: The Correct Way to Validate Email Addresses

#401
post #377

Earlier quoted context omitted.

There are already things that are technically allowed by RFCs for various types of input but should be disallowed because they cause problems. So something being in an RFC doesn't create any kind of binding requirement, and very often the things that get dropped are things that, on contact with the real world, turned out to be bad ideas. Many of the more arcane things that can technically be done in an email address…

> There are already things that are technically allowed by RFCs for various types of input but should be disallowed because they cause problems. That may be true, but it's something else entirely for someone to drop them because the problems they cause … were enabled by him. An email address using characters you don't like is perfectly valid, and perfectly deliverable, right up until you refuse to deliver it. It does…

I would prefer to allow plus, dot, hyphen, underscore, and alphanumeric characters in the local part and probably not much of anything else.

I prefer this because I work in a world where email addresses are provided to me, and possibly stored and then retrieved and used and even displayed, as text, and the RFCs allow some nightmarish things when you consider the interaction of the syntax the RFCs permit and the set of characters which are sensitive to one or more of the non-MTA components of that chain.

Your original example, for instance, contains characters that require escaping or at least careful handling for multiple situations, and even goes so far as to contain things that will be interpreted as escape sequences in some contexts. I'm sure that Robert(';DROP TABLE users;)(alert("Bobby Tables"))@not.a.hacker(honest) will be terribly disappointed to know that he needs to use a different address to register on my site. I'll send him over to you instead.

Re: The Correct Way to Validate Email Addresses

#402

Earlier quoted context omitted.

The key here is "BASIC", something like [a-z]@[a-z] so at least they will have a at sign. Did you even read?

I can't tell if you're being sarcastic or not, because that's perfectly proving my point. That validation bans anyone with a number immediately before the @, which includes my email address.

I was not.

Re: The Correct Way to Validate Email Addresses

#403

Earlier quoted context omitted.

I may have erred in giving the impression that the application-level checks are the only line of defense here. They're not. The (bespoke) MTA underlying this product performs most if not all of these checks as well. I didn't really spend any time on that side of the business, so I might be wrong about that, but it would be something of a surprise. I do know our analytics needed to be able to cope usefully with an ast…

> Checking whether an email address's domain-part is an RFC1918 IP is actually pretty easy. What I still don't understand: Why do that at all? What's the point of this? Security? Preventing user errors? What else?

Little of both.

We were pretty sure it would already be impossible, or nearly so, for a malicious user to probe our infrastructure this way, but when it's so simple to be even more sure, why not?

Similarly, we'd already observed a low but nonzero rate of users inadvertently providing such addresses - not during signup or onboarding so much, but in recipient lists they submitted. Since we used the same recipient checking code everywhere, why not cut that back to zero, too?

Re: The Correct Way to Validate Email Addresses

#404

Earlier quoted context omitted.

Had this bug in a system I was working on. Pushed a patch in april.. and there still is an ongoing discussion whether it should be merged or not.

Why is there a discussion? What do the people who don't want to take the patch say? "We don't care if we lose customers with unusual names"?

Because of code style (I do not mean spaces or tabs, it is beyond that). Different developers have different ideas of how a function should behave, where it literally has no effect on how the rest of the system works.
Post reply on HN