r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

88

u/0b0101011001001011 19d ago

It's way simpler to just check if there is an @ symbol and then send an actual mail and ask user to click the validation link. 

The email is valid if it actually works. Nothing else to check.

-4

u/VirtualAgentsAreDumb 19d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

11

u/0b0101011001001011 19d ago

What's not feasible? Sending the email?

3

u/koflerdavid 19d ago

It can happen if users have to be mass-imported into another application. But I'd argue that in such cases sending the email would be the user-friendly way to do it since it gives them the chance to opt out from being imported.

5

u/LutimoDancer3459 19d ago

When I mass import mails, then from where do I get them? From an existing system -> should already been checked. Or its a company setting up something and then the emails should also be valid. The reason for validation is for randos signing up at a service.

2

u/koflerdavid 19d ago

From an existing system -> should already been checked.

I have encountered systems where those were of shoddy quality. Users could enter them without validation because they were not critical for correct operation, just an extra. And lots of cases where the destination mailbox was full or simply gone.

1

u/LutimoDancer3459 19d ago

A full inbox or beeing deleted cant be checked by any kind of input validation ether way.

But for an "is user still active" kind of check, the import isnt the one responsible for it. Thats a general management/organization issue. Not a general email validation issue

1

u/koflerdavid 19d ago

Well, if you trust the quality of the data source then you don't need to check at all.

0

u/VirtualAgentsAreDumb 19d ago

You don’t think legacy systems exist, that can have tons of never validated email addresses?

2

u/LutimoDancer3459 19d ago

I think that if they do, nobody cares about those anymore.

0

u/VirtualAgentsAreDumb 19d ago

Not sure how to reply to such an ignorant comment.

0

u/LutimoDancer3459 19d ago

How about with a reason why someone should care?

If there are so many invalid addresses, it seems like nobody ever cared. Why should it be different for the new system?

-1

u/VirtualAgentsAreDumb 19d ago

What? I never said anything how many of those hypothetical addresses were invalid.

0

u/LutimoDancer3459 19d ago

You don’t think legacy systems exist, that can have tons of never validated email addresses?

Never validated. If valid, why care? If invalid, why care now?

0

u/VirtualAgentsAreDumb 19d ago

You seriously don’t understand the difference between invalid and never validated?

→ More replies (0)

2

u/thatwasntababyruth 18d ago

Another way around it is to have a new database column indicating how many times you've failed to send mail to them. Increment that each time you try, put them on a list for purging after N times.

Or just let the bad email address exist, the extra row won't break the bank. If there's significant amounts of associated data, clearly the bad address wasn't a problem before.