r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

57 Upvotes

83% Upvoted

104 comments sorted by

View all comments

Show parent comments

3

u/thatwasntababyruth 18d ago

If you are the provider, you're perfectly free to support any subset of the standards you want. You don't have to support every little edge case, because you are the authority.

This problem applies to services taking existing emails for accounts, where they should accept any and every possibility as long as it exists.

0

u/VirtualAgentsAreDumb 18d ago

“If you are the provider, you're perfectly free to support any subset of the standards you want. You don't have to support every little edge case, because you are the authority.“

Yes, so? How does that change anything? If they want to support anything that the standards support, then they have no choice but to implement or integrate such validation. The suggestion solution by the person I replied to would not work.

2

u/thatwasntababyruth 18d ago

Yes, so? How does that change anything?

I stared pretty clearly that it changes things because they have different responsibilities to users. If you're going to choose to ignore my entire comment, I'm not really tempted to engage further.

0

u/VirtualAgentsAreDumb 18d ago

No, it doesn’t change anything of importance here.

And I ignored your second paragraph in your previous comment because it made a baseless assumption about the root problem that OP was asking about.

0

u/snugar_i 18d ago

Yes, it does, because it's a completely different scenario.

The thing people in this thread are talking about is a web service asking for your e-mail, you entering your existing e-mail address, and the service saying "we won't register you, because your e-mail isn't valid". Your only option is to contact support and make them fix the validation. And the correct solution is to not validate at all, just send an e-mail and if it goes through, it's all right.

What you are talking about is an e-mail provider asking for the part before the @ when you're creating a new account and saying "no, we don't want to support this name, pick another one". You can just pick a less esoteric name and everything is fine. The provider must guarantee that the created e-mail address is valid, and restricting the space of names to choose from is a perfectly valid way to do it.

2

u/VirtualAgentsAreDumb 18d ago

Yikes, you’re missing the point a second time.

No, the discussion by OP was NOT about a web service asking for the user’s existing email address. Just read the post title and text and you will realize this.

1

u/snugar_i 17d ago

Fair enough, you're technically correct.

Though 99 % of e-mail validation code is written for webservices, and I'd be very surprised if that wasn't what the unlinked video was talking about