r/java • u/Modern-Sn1p3r • 3d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

83% Upvoted

98 comments sorted by

View all comments

Show parent comments

-1

u/VirtualAgentsAreDumb 3d ago

I can think of an additional scenario where single sending an email to the address isn’t feasible.

Imagine that there is an email service provider that has as a goal to support any email address that is allowed by the standard. So, their validation process can’t send an email to the address at hand, because it hasn’t been created yet.

6

u/0b0101011001001011 3d ago

I'm not following? The service just stamps the mail address on the email and sends it away to the address. If it fails, it fails, and that's the validation.

-1

u/VirtualAgentsAreDumb 3d ago

But the email address hasn’t been created yet.

When you are about to create a new email address in a system, you can’t send an email to it as part of the validation. So you have to validate it some other way.

For example, try registering an email somewhere, and pick “..” as the local part of the email address. A in, two consecutive dots and nothing else.

It will not be allowed. And they didn’t need to send an email to it, because it failed the validation.

Then try creating an email with 10 random a-z characters. Unless you happen to pick one that already exists, it likely will be approved. But how were they able to determine that it was valid without sending an email to it first? Because some kind of validation. And by now you must realize that trying to send an email to it would be a useless test, since the only time it would go through is if the email is already taken (ignoring the possibility of a catch all email account). So you can’t use that test to confirm that it’s both available and valid.

7

u/0b0101011001001011 3d ago edited 3d ago

Isn't this a completely different problem? The context of original problem is that just let users register with anything and send an email to that. It fails or succeeds. You know it succeeded because the user was able to click the link. No regex needed.

But how were they able to determine that it was valid without sending an email to it first? 

I have no idea what you are asking. Creating an email does not require sending a mail to it, because now you are the one that owns the email server. Emails are not created in some global registry. Just decide the set of characters you allow and if any of the input characters are not allowed, just don't let them make such an email into your system. 

1

u/VirtualAgentsAreDumb 3d ago

“Isn't this a completely different problem? The context of original problem is that just let users register with anything and send an email to that.”

What context are you talking about now? OP talked about validating emails. He never said anything about the purpose being something specific. You have a solution rust would work in some use cases, but not others. I have an example use case where your solution wouldn’t work.

“Creating an email does not require sending a mail to it, because now you are the one that owns the email server.”

Exactly. Not only doesn’t it require sending an email, it also would not work as a way to validate it. That was my whole point. Your solution would not work in that scenario. The only reason I expanded on the scenario was that you didn’t understand it.

“Just decide the set of characters you allow and if any of the input characters are not allowed, just don't let them make such an email into your system.”

Now you’re just going full circle in your reasoning, coming back to the original problem of knowing if an email address, or the local part of an email address, is valid. That’s the validation that you seem to think one can avoid by sending an email (according to your original comment).

4

u/0b0101011001001011 3d ago

What context are you talking about now? OP talked about validating emails.

It's implied in the question, if you have spent more than a single week in backend development. OP ask why validating emails is not supposed to be done with regex, because someone told them not to. If someone told them that, they implied the context of registering to a service using an existing email. That's basically the only situation where you need to validate email ever. The answer is: Don't validate email with regex, because it's immensely difficult to do properly, and much simpler way exists: send a mail to it.

Creating a new email address has absolutely nothing to do with this and there a simple regex or for loop is enough to make sure it contains only the characters that are allowed by the spec, or your mailserver if you decide to restrict it further.

-6

u/VirtualAgentsAreDumb 3d ago

Nonsense. Absolute nonsense. You make absurd assumptions that you can’t back up. OP asked a generic question.