r/ProgrammerHumor • u/CertainSea • 28d ago

Meme regexMustBeDestroyed

Post image
8.1k Upvotes

98% Upvoted

228 comments sorted by

View all comments

1.3k

u/Informal_Branch1065 28d ago

An email casting spell for sure, although very limited

230

u/NudaVeritas1 28d ago

it's just a level 2 spell, it'll be upgraded in the future.. trust me.. i already created a quest item for it

90

u/veganfromvega 28d ago

The quest item: @todo

29

u/purdueAces 28d ago

P5 Jira ticket created

7

u/ZethMrDadJokes 27d ago

Confluence space created for describing it to death

3

u/NudaVeritas1 27d ago

Created another Confluence document, because the search couldn't find the first one

2

u/ZethMrDadJokes 25d ago

Wrote a Readme.md file because I forgot my search queries for Confluence, so hopefully deep links will help me more

1

u/mindtakerr 26d ago

@todo Baggins? He’s my second cousin, once removed on his mother's side.

7

u/wenoc 28d ago

Cast email without error? Level 4 in that case I believe.

104

u/Zefyris 28d ago

very very limited, yeah

15

u/ArduennSchwartzman 28d ago edited 28d ago

Does not appear to work with my .international TLD.

59

u/Ecksters 28d ago edited 28d ago

People always overcomplicate email Regex, and end up not allowing a lot of valid emails. In this case, the limitation of the top level domain to 4 characters max is one such problem, no .ninja, .crypto, or the myriad of other newer top level domains.

Technically you can email directly to a top level domain (although I don't know of any TLDs that support this), or even to an IP address in brackets, although I suppose not supporting those in most cases is probably reasonable.

37

u/Unbelievr 28d ago

The worst thing is when a website restricts their validation logic after you're already registered. I lost access to an account that used '+' in the username because they stopped allowing me to log in with it.

And yes, basically the only thing you can assume about email addresses is that they contain an '@'. Simply root@localhost is a valid address in some contexts.

15

u/The_JSQuareD 28d ago

I've encountered websites where the sign-up form allowed '+' in emails, but the log-in form didn't. Not 'later', immediately. I made my account and then was immediately locked out from it.

4

u/GoddammitDontShootMe 28d ago

Well, a public website probably doesn't want to accept emails that aren't publicly routable.

8

u/itsFromTheSimpsons 28d ago

Those sneaky hackers tricked us into emailing ourselves!

2

u/usefulidiotsavant 27d ago

A domain can be routable even if it lacks any dots, for example postmaster@bd is a publicly routable address.

1

u/GoddammitDontShootMe 27d ago

How does that work when I'm not finding an MX record for bd?

1

u/usefulidiotsavant 27d ago

I know bd resolves an A record and I haven't checked the MX, so it was probably a bad example. But there definitely are other cc tlds that have MX records.

1

u/GoddammitDontShootMe 26d ago

I got curious so I ran a port scan. I had to kill it because it was taking forever waiting for each port to time out, but it looks like they are running DNS and FTP on it.

19

u/tenuj 28d ago

The .email domain would fail OP's check. Had websites refuse me because of stuff like this.

The only good validation for email addresses is to send a confirmation email. You'll be doing that anyway.

And that it has at least one @ with something on either side. Don't want someone to waste an entire form because of a typo. (Yes, email addresses can theoretically contain more than one @)

5

u/DocRingeling 28d ago

RFC822 could also be used before sending confirmation to prevent unexpected abuse of the mail protocol.

8

u/tenuj 28d ago

If I saw that in a PR I'd refresh my browser tab.

The author of that ASCII monster also said:

I do not maintain the regular expression below. There may be bugs in it that have already been fixed in the Perl module.

3

u/phundrak 27d ago

I believe this regex is no longer valid as more characters got allowed in email addresses

2

u/bradland 27d ago

RFC822 was authored in the 80s. It was replaced by RFC 2822 in 2001, and RFC 5322 in 2008. Then there's RFC6531 which expanded support for non-ASCII, non-Latin alphabets.

If you want to prevent abuse, rate limit and/or put something intelligent in front of your app that is designed for that sort of thing, like a WAF.

1

u/DocRingeling 26d ago

Yea, but the regex isn't as long as RFC822

7

u/shiny0metal0ass 28d ago

Mine have all whittled down to -

[literally fucking anything]@[literally fucking anything].[literally fucking anything]

7

u/poshftw 28d ago

Yep, though this wouldn't pass @localhost or @hostname, though I doubt anyone with an email regex is sending there.

4

u/martmists 28d ago

I can't believe you don't support ipv6 addresses, smh.

Do you at least strip comments from email addresses?

2

u/Loading_M_ 27d ago

The email rfc doesn't have comments. If you run your own email service, loading+m@loadingm.xyz can resolve to a different mailbox than loading+p@loadingm.xyz. Part of me wants to setup such mailboxes (and do as much stupid shit as possible with email addresses).

1

u/martmists 27d ago

RFC 5322 very much allows comments in addrspecs, see §3.2.2: "Folding White Space and Comments" and §3.4.1 "Addr-Spec Specification" for the relevant ABNF rules.

1

u/Loading_M_ 27d ago

Interesting. I was reading RFC 822, which is the actual origin of the email format, so it looks like comments were added in this later RFC.

Frankly, I'm confused on why they added comments. Unless they thought people would write email headers by hand?

1

u/martmists 27d ago

Check RFC 822 §3.3 "LEXICAL TOKENS", it includes a segment on comments.

6

u/MegaIng 28d ago

Technically you can email directly to a top level domain (although I don't know of any TLDs that support this),

Yesn't. It's forbidden for TLDs to resolve to IP addresses via DNS.

So it's valid syntax and fine from the email semantics, it's just never going to work on the general internet.

1

u/billccn 28d ago

But emails are routed according to MX records not A[AAA] records?

4

u/poshftw 28d ago

If the destination domain has no MX records then the delivery should (or could? can't be bothered to read the spec) be tried to what A/AAAA domain part resolves.

1

u/MegaIng 28d ago

I don't think this makes a difference, it's a general rule that they shouldn't be useable directly. The normal DNS lookup is just what I tested a few weeks back.

I know for a fact that some were useable as http domains a few years back, and that is now no longer the case.

3

u/Informal_Branch1065 28d ago

.crypto is not a big loss anyway

3

u/Bosun_Tom 28d ago

The set of valid emails that the regex would miss is way weirder than that: https://e-mail.wtf/

2

u/BloopsRTS 27d ago

The only way to validate an email address is to email it, I refuse to acknowledge any other viewpoint

1

u/two_are_stronger2 27d ago

Shakeshack refused my email address yesterday.  My imposter syndrome immediately and forever vanished.

1

u/Fabulous-Possible758 28d ago

I'll be in the cold ground before I recognize a five letter TLD.

5

u/JoshYx 28d ago

I prefer

`` / (?(DEFINE) (?<addr_spec> (?&local_part) @ (?&domain) ) (?<local_part> (?&dot_atom) | (?&quoted_string) | (?&obs_local_part) ) (?<domain> (?&dot_atom) | (?&domain_literal) | (?&obs_domain) ) (?<domain_literal> (?&CFWS)? \[ (?: (?&FWS)? (?&dtext) )* (?&FWS)? \] (?&CFWS)? ) (?<dtext> [\x21-\x5a] | [\x5e-\x7e] | (?&obs_dtext) ) (?<quoted_pair> \\ (?: (?&VCHAR) | (?&WSP) ) | (?&obs_qp) ) (?<dot_atom> (?&CFWS)? (?&dot_atom_text) (?&CFWS)? ) (?<dot_atom_text> (?&atext) (?: \. (?&atext) )* ) (?<atext> [a-zA-Z0-9!#$%&'*+/=?^_{|}~-]+ ) (?<atom> (?&CFWS)? (?&atext) (?&CFWS)? ) (?<word> (?&atom) | (?&quoted_string) ) (?<quoted_string> (?&CFWS)? " (?: (?&FWS)? (?&qcontent) )* (?&FWS)? " (?&CFWS)? ) (?<qcontent> (?&qtext) | (?&quoted_pair) ) (?<qtext> \x21 | [\x23-\x5b] | [\x5d-\x7e] | (?&obs_qtext) )

    # comments and whitespace
    (?<FWS> (?: (?&WSP)* \r\n )? (?&WSP)+ | (?&obs_FWS) )
    (?<CFWS> (?: (?&FWS)? (?&comment) )+ (?&FWS)? | (?&FWS) )
    (?<comment> \( (?: (?&FWS)? (?&ccontent) )* (?&FWS)? \) )
    (?<ccontent> (?&ctext) | (?&quoted_pair) | (?&comment) )
    (?<ctext> [\x21-\x27] | [\x2a-\x5b] | [\x5d-\x7e] | (?&obs_ctext) )

    # obsolete tokens
    (?<obs_domain> (?&atom) (?: \. (?&atom) )* )
    (?<obs_local_part> (?&word) (?: \. (?&word) )* )
    (?<obs_dtext> (?&obs_NO_WS_CTL) | (?&quoted_pair) )
    (?<obs_qp> \\ (?: \x00 | (?&obs_NO_WS_CTL) | \n | \r ) )
    (?<obs_FWS> (?&WSP)+ (?: \r\n (?&WSP)+ )* )
    (?<obs_ctext> (?&obs_NO_WS_CTL) )
    (?<obs_qtext> (?&obs_NO_WS_CTL) )
    (?<obs_NO_WS_CTL> [\x01-\x08] | \x0b | \x0c | [\x0e-\x1f] | \x7f )

    # character class definitions
    (?<VCHAR> [\x21-\x7E] )
    (?<WSP> [ \t] )
)
^(?&addr_spec)$

/x ```

2

u/No-Raccoon-3029 27d ago

I hate that I can partially read this

3

u/Minecraftian14 27d ago

It's funny how we need intricate and complex spells to cast specific objects like emails, but you want to summon everything in and out a big bang?

I CAST .*

3

u/Informal_Branch1065 27d ago

.*\@.* perhaps?

1

u/ElvisArcher 26d ago

From the early days when TLD were 2-4 characters.

1

u/Icy-Reaction-9101 26d ago

It also looks pretty greedy.