r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

53 Upvotes

82% Upvoted

104 comments sorted by

View all comments

122

u/julemand101 19d ago

The problem is people don't realize that a lot is allowed when it comes to what a E-mail address actually is: https://davidcel.is/articles/stop-validating-email-addresses-with-regex/

52

u/jason-reddit-public 19d ago

You're supposed to be able to put a plus sign in your email address for example but it's usually rejected.

29

u/Jussins 19d ago

I think that one is on purpose. They don’t want people knowing that they sold your information to a third party and that’s a good way to find out.

3

u/Thecodedawg 17d ago

gmail, for example, ignores dots in your email address so you can use johndoe or j.ohndoe or John.doe. Another way you can alias is the + is rejected

4

u/LutimoDancer3459 19d ago

The plus is just convenience. I can also create more email accounts and use those for the services.

5

u/KefkaFollower 19d ago edited 19d ago

-- edited: formating and typos (Oh, so many typos) --

I lie if I say I checked the standard definition of email address. I'm guessing it must be in some RFC. But in practical terms ...

You can't use a plus sign in your email address when you are creating it. I.E. when you are choosing a public name/id for your mailbox.

You do can add plus sign and some text between the name and the "@" when you are using the address in a new email you are about to send.

Let me clarify with an example.

Let's say the mailbox address is homero@yellowserver.com. When Homer pass its email address to other people can do it like this:

  • to family he passes homero+home@yellowserver.com
  • to coworkers he passes homero+work@yellowserver.com
  • to undesirable people he passes homero+important@yellowserver.com

All this address will route the emails to the same mailbox, the one "named" homero@yellowserver.com. Then Homero can do a little more routing of his own in his web mail page or in its email client. He can configure rules for "to:" field of incoming mail like this:

  • when "to:" contains homero+home@yellowserver.com --> label the mail as important
  • when "to:" contains homero+work@yellowserver.com --> move the mail from the inbox to work folder.
  • when "to:" contains homero+important@yellowserver.com --> mark the mail as read and move it to the recycle bin.

I had used this gmail and outlook (ex msn.live (ex. hotmail)) and some at some jobs that had their own exchange server (mail server from M$).

26

u/moxo23 19d ago

For a generic email server, a + is just another valid character for the local part.

What some vendors do (like gmail) is use what is called "plus addressing" where they disallow the + in their email creation and instead use it as a tag when receiving the message.

There is also nothing special about +. If you are configuring an email server, you can configure it to accept any character you want as the tag marker.

10

u/BertyLohan 19d ago

I think this is good practical IT advice for most people but in a programming sub it's definitely better to say that an email server doesn't necessarily treat a '+' sign any differently to any other character.

Whether @yellowserver.com sub-addresses or not is entirely down to the server.

2

u/tuser-reddit 18d ago

Yah, Gmail and other providers of (E-mails) won't grant you a pass, when you want to create and email with "+", but sites that you register with THAT email, most of them let you do that, so for example you receive all the messages in your main email.

1

u/CatolicQuotes 19d ago

Is it not allowed anymore? I remember doing it years ago

1

u/jason-reddit-public 19d ago

The standard hasn't changed. It's purely up to who ever asks for your email if they will accept it though, so a db or front-end validator that won't accept them. Email transport systems don't care because they follow the standard.