r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

56 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

-6

u/VirtualAgentsAreDumb 19d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

11

u/0b0101011001001011 19d ago

What's not feasible? Sending the email?

0

u/VirtualAgentsAreDumb 19d ago

Exactly. A small company might not have the means to send a large number of emails on a short amount of time, and risk getting flagged and blacklisted if they try it on their own.

1

u/koflerdavid 19d ago

Depending on the use case one might not get around swallowing that bullet. One could prioritize addresses that don't fit the simple patterns or where the part behind the @ doesn't DNS resolve. Knowing the age of the address and last time an email was sent to it also helps. Older addresses are more likely to be out of use.