Problem/Motivation
In some rare cases users accidentally(?) enter a space immediately before the @ sign in email addresses. This is RFC-compliant, but deprecated and triggers a warning in Egulias\EmailValidator\Validation\RFCValidation->isValid.
So an email address like this would be valid, but most servers do not handle it, triggering an error error while sending the mail:
mmbk @example.org
Steps to reproduce
- Use any form that has an email field (for example the
/admin/config/system/symfony-mailer-lite/test) - Enter an address containing a space before the "at" sign, like
mmbk @example.org - The mail transfer will fail
(sorry for the german screenshot )
Proposed resolution
egulias/email-validator supports another validator NoRFCWarningsValidation that is doing the same validations and treats the warnings as errors, so a mail like this cannot be entered.
Remaining tasks
Basically the change is:
diff --git a/lib/Drupal/Component/Utility/EmailValidator.php b/lib/Drupal/Component/Utility/EmailValidator.php
index f1345d03b1..f86efa7411 100644
--- a/lib/Drupal/Component/Utility/EmailValidator.php
+++ b/lib/Drupal/Component/Utility/EmailValidator.php
@@ -4,7 +4,7 @@ namespace Drupal\Component\Utility;
use Egulias\EmailValidator\EmailValidator as EmailValidatorUtility;
use Egulias\EmailValidator\Validation\EmailValidation;
-use Egulias\EmailValidator\Validation\RFCValidation;
+use Egulias\EmailValidator\Validation\NoRFCWarningsValidation;
/**
* Validates email addresses.
@@ -27,7 +27,7 @@ class EmailValidator extends EmailValidatorUtility implements EmailValidatorInte
if ($email_validation) {
throw new \BadMethodCallException('Calling \Drupal\Component\Utility\EmailValidator::isValid() with the second argument is not supported. See https://www.drupal.org/node/2997196');
}
- return parent::isValid($email, (new RFCValidation()));
+ return parent::isValid($email, (new NoRFCWarningsValidation()));
}
}
User interface changes
NONE
Introduced terminology
NONE
API changes
NONE
Data model changes
NONE
| Comment | File | Size | Author |
|---|---|---|---|
| Bildschirmfoto vom 2025-04-25 13-51-42.png | 44.86 KB | mmbk |
Issue fork drupal-3521184
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3521184-email-validation-allows
changes, plain diff MR !11962
Comments
Comment #2
mmbkSitenotes:
- Actually I don't understand the reason why it's not allowed to pass other validators into the `isValid` method.
- Maybe it's a good idea to make the validator configurable in the mailer settings?
Differences between the validators found in my research:
RFCValidation:
Validates email addresses according to RFC 5322, including some edge cases and deprecated features, such as:
Quoted strings
Folding white space (FWS)
Comments
Space before the @ (technically valid per RFC but rarely supported)
This validator returns emails as valid even if they include unusual but technically RFC-compliant formats. It may emit warnings, which are important if you want to avoid deprecated or problematic formats.
NoRFCWarningsValidation:
This is a stricter validator. It still uses RFC rules, but any format that triggers an RFC warning—like a space before @—is considered invalid.
Comment #3
cilefen commented#3061074: egulias/EmailValidator prior to 2.1.22 allows addresses with a space in the domain part suggests this was previously fixed for some other case.
Comment #4
annmarysruthy commentedComment #6
annmarysruthy commentedComment #7
smustgrave commentedCan we get a test showing this problem
Comment #8
prabha1997 commentedI have added assertFalse() for the invalid email case (example@example) in the testIsValid() method to ensure that it correctly returns false when an invalid email is passed
Comment #9
prabha1997 commentedComment #10
prabha1997 commentedThank you for your feedback.
I've now added the following assertion to cover the invalid email case with a space:
$this->assertFalse($validator->isValid('example @example.com'));Please let me know if any further changes are needed.
Comment #11
smustgrave commentedThnk a last step would be to get a CR written as this could be a behavior change for some
Comment #13
dcam commentedI added a change record at https://www.drupal.org/node/3557004.
Comment #14
smustgrave commentedSorry for the delay, can this get a rebase. Gitlab is not doing it so assume there is a small conflict or fuzziness.
Comment #15
smustgrave commentedComment #16
dcam commentedRebased
Comment #17
smustgrave commentedLGTM
Comment #19
needs-review-queue-bot commentedThe Needs Review Queue Bot tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".
This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.
Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.
Comment #20
dcam commentedPost-bot-rebellion rebase
Comment #21
longwaveAgree with the MR comment, let's swap to example.com instead of localhost.com.
Comment #22
dcam commentedThe addresses were changed to
@example.com.Comment #23
smustgrave commentedFeedback appears to be addressed on this one
Comment #26
amateescu commentedCommitted and pushed 2d81003d5dd to main and 86cf98b5791 to 11.x. Thanks!
Also closed #3307810: Figure out how email contraint bound to egulias email validator as a duplicate and transferred issue credit over here.
Comment #29
ressaThanks for reporting and fixing this :) Just adding formatting for code and correcting some typos.