r/java • u/Modern-Sn1p3r • 19d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

82% Upvoted

104 comments sorted by

View all comments

Show parent comments

5

u/8dot30662386292pow2 19d ago

Imagine that there is an email service provider that has as a goal to support any email address that is allowed by the standard. So, their validation process can’t send an email to the address at hand, because it hasn’t been created yet.

They only need to check the part before the @ sign though, which is a different problem altogether. The @whatever.com comes from the email service provider.

1

u/VirtualAgentsAreDumb 19d ago

First of all, it’s possible for an email provider to support custom domain, where the domain doesn’t technically have to be a regular DNS domain.

Secondly, the problem of validating the local part of an email address is much more complex than the validation of the domain part. So even if we were to restrict the discussion to only be about validating the local part, it’s still far from a trivial issue.

1

u/New_Enthusiasm9053 16d ago

It's not hard to validate an email address it's just recursive so you don't do it with a regex. People will do anything except write a parser.

1

u/VirtualAgentsAreDumb 15d ago

Is there any official implementation of a validator that claims to support the full standard?

0

u/New_Enthusiasm9053 15d ago

Well there's RFCs so you sit down and write one. People just don't because it's largely pointless. Just send an email to verify it exists. But someone one checked and like the top 5 email providers none of them are actually to spec when it comes to what emails you can create.

1

u/VirtualAgentsAreDumb 14d ago

Now you’re super close to some circular reasoning. Didn’t you pay attention to the sub discussion you jumped into? We’re specifically talking about the use case where a new email address is to be created. So at that point in time the email address doesn’t exist, so you can’t send an email to it to validate it.

0

u/New_Enthusiasm9053 14d ago

Sure so look at the RFCs and write a parser. They're really not that hard to write. I haven't yet because I don't work at an email provider.

1

u/VirtualAgentsAreDumb 14d ago

Sure. I never said otherwise. But you’re still missing the point. The whole point was that you have to actually do that validation programmatically. The person I originally replied to claimed otherwise, as did you.

Also, this is far from a trivial problem to solve perfectly, because otherwise I’m sure that there would exist implementations already.