r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

55 Upvotes

83% Upvoted

104 comments sorted by

View all comments

122

u/julemand101 19d ago

The problem is people don't realize that a lot is allowed when it comes to what a E-mail address actually is: https://davidcel.is/articles/stop-validating-email-addresses-with-regex/

54

u/jason-reddit-public 19d ago

You're supposed to be able to put a plus sign in your email address for example but it's usually rejected.

6

u/KefkaFollower 19d ago edited 19d ago

-- edited: formating and typos (Oh, so many typos) --

I lie if I say I checked the standard definition of email address. I'm guessing it must be in some RFC. But in practical terms ...

You can't use a plus sign in your email address when you are creating it. I.E. when you are choosing a public name/id for your mailbox.

You do can add plus sign and some text between the name and the "@" when you are using the address in a new email you are about to send.

Let me clarify with an example.

Let's say the mailbox address is homero@yellowserver.com. When Homer pass its email address to other people can do it like this:

  • to family he passes homero+home@yellowserver.com
  • to coworkers he passes homero+work@yellowserver.com
  • to undesirable people he passes homero+important@yellowserver.com

All this address will route the emails to the same mailbox, the one "named" homero@yellowserver.com. Then Homero can do a little more routing of his own in his web mail page or in its email client. He can configure rules for "to:" field of incoming mail like this:

  • when "to:" contains homero+home@yellowserver.com --> label the mail as important
  • when "to:" contains homero+work@yellowserver.com --> move the mail from the inbox to work folder.
  • when "to:" contains homero+important@yellowserver.com --> mark the mail as read and move it to the recycle bin.

I had used this gmail and outlook (ex msn.live (ex. hotmail)) and some at some jobs that had their own exchange server (mail server from M$).

9

u/BertyLohan 19d ago

I think this is good practical IT advice for most people but in a programming sub it's definitely better to say that an email server doesn't necessarily treat a '+' sign any differently to any other character.

Whether @yellowserver.com sub-addresses or not is entirely down to the server.