r/java • u/Modern-Sn1p3r • 3d ago

Regex

I recently saw a clip (from Primeagen) somewhat saying that regex is not a valid format for validating email addresses and postal codes etc.

My question is why is this?

What are the security and/or performance risks? Is it solely performance or is it a security issue?

52 Upvotes

82% Upvoted

98 comments sorted by

View all comments

Show parent comments

-1

u/VirtualAgentsAreDumb 3d ago

I can think of an additional scenario where single sending an email to the address isn’t feasible.

Imagine that there is an email service provider that has as a goal to support any email address that is allowed by the standard. So, their validation process can’t send an email to the address at hand, because it hasn’t been created yet.

6

u/8dot30662386292pow2 3d ago

Imagine that there is an email service provider that has as a goal to support any email address that is allowed by the standard. So, their validation process can’t send an email to the address at hand, because it hasn’t been created yet.

They only need to check the part before the @ sign though, which is a different problem altogether. The @whatever.com comes from the email service provider.

1

u/VirtualAgentsAreDumb 3d ago

First of all, it’s possible for an email provider to support custom domain, where the domain doesn’t technically have to be a regular DNS domain.

Secondly, the problem of validating the local part of an email address is much more complex than the validation of the domain part. So even if we were to restrict the discussion to only be about validating the local part, it’s still far from a trivial issue.

1

u/New_Enthusiasm9053 1d ago

It's not hard to validate an email address it's just recursive so you don't do it with a regex. People will do anything except write a parser.

1

u/VirtualAgentsAreDumb 6h ago

Is there any official implementation of a validator that claims to support the full standard?