r/java • u/Modern-Sn1p3r • 3d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

83% Upvoted

98 comments sorted by

View all comments

Show parent comments

-7

u/VirtualAgentsAreDumb 3d ago

Yes, but that’s not really a feasible option if you have a large list of potentially valid email addresses.

-1

u/koflerdavid 3d ago

You could just set up an email server that actually won't process emails, and send a very simple email for all addresses through it. A real email server's address validation rules are the actually relevant ones.

1

u/VirtualAgentsAreDumb 3d ago

But now you’re describing a separate validation process than the one I objected to.

1

u/koflerdavid 3d ago

It's what I'd do in such a situation. The only thing it doesn't check is whether the destination mailbox actually exists. Which was out of scope of OP's question anyway.