Email validation: do not authorize email like xx@xx [#3327190]

Problem/Motivation

Currently an email address like xx@xx passes clientside validation but it is rejected by server side validation.

This is due to the fact that the JS validation provided by the jQuery validation library is done on RFC1123 (https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address), which authorizes this possibility.

Whereas Drupal Core validation, done with PHP library egulias/email-validator is against another RFC which does not authorize that.

Proposed resolution

Override jquery validate email validation regex to avoid this possibility.

Remaining tasks

Create MR.

Comment	File	Size	Author
#8	clientside_validation-3327190-8.patch	3.84 KB	grimreaper
#5	clientside_validation-3327190-5.patch	2.09 KB	striknin
#3	clientside_validation-3327190-3.patch	2.68 KB	grimreaper

Issue fork clientside_validation-3327190

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3327190-email-validation-do changes, plain diff MR !10
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

14 December 2022 at 15:43

Grimreaper created an issue. See original summary.

Comment #2

14 December 2022 at 16:10

Grimreaper opened merge request !10

Comment #3

grimreaper

French

France 🇫🇷

commented 14 December 2022 at 16:18

Assigned:	grimreaper	» Unassigned
Status:	Active	» Needs review

Status	File	Size
new	clientside_validation-3327190-3.patch	2.68 KB

Uploading patch for easier composer usage.

Thanks for the review!

Comment #4

j. commented 6 April 2023 at 17:50

Thank you for the patch. I was having issues with forms submitting with email adress just like that and triggering wierd errors on the server side. This fixed it.

I am using drupal 9.7 and php 7.4.

Comment #5

striknin commented 13 April 2023 at 13:58

Status	File	Size
new	clientside_validation-3327190-5.patch	2.09 KB

Hi, thanks for this usefull patch.
But what about email addresses with subdomain, like XXX@sub.domain.ext ?

We need to allow repeated segments with dots, after the @.
So, by changing the regex by the one proposed in this new patch, the validation passes for email addresses with subdomain.

Comment #6

grimreaper

French

France 🇫🇷

commented 10 May 2023 at 11:05

Assigned:	Unassigned	» grimreaper
Status:	Needs review	» Needs work

Hi,

@Striknin, thanks for the patch, this is a case I am encountering on my project too.

But with this patch, xx@xx is now valid again which was the original point of the issue.

I will update the MR.

Comment #7

grimreaper

French

France 🇫🇷

commented 10 May 2023 at 11:21

Status:

Needs work

» Needs review

This is regex from Jquery library:

return this.optional( element ) || /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test( value );

This is the new proposed one:

return this.optional( element ) || /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+$/.test( value );

I removed the "?" to have a first domain part. And changed the "*" to "+" to have any depth of subdomains. But with at last a first level.

xxx@xxx => FALSE
xxx@xxx.xxx => OK
xxx@xxx.xxx.xxx => OK

etc.

Comment #8

grimreaper

French

France 🇫🇷

commented 10 May 2023 at 11:22

Assigned:

grimreaper

» Unassigned

Status	File	Size
new	clientside_validation-3327190-8.patch	3.84 KB

2 files were hidden/shown/deleted

Status	File	Size
hidden	clientside_validation-3327190-3.patch	2.68 KB
hidden	clientside_validation-3327190-5.patch	2.09 KB

Uploading patch for Composer usage.

Comment #9

striknin commented 17 May 2023 at 16:56

Hello,
@Grimreaper you're absolutely right! My bad, I didn't re-check after changing the regex ...
It's now perfect, thank you !

Comment #10

grimreaper

French

France 🇫🇷

commented 23 May 2023 at 07:23

Status:

Needs review

» Reviewed & tested by the community

@Striknin, thanks to have re-tested.

Changing to RTBC regarding comment 9.

Comment #11

nigelcunningham commented 14 November 2023 at 04:09

Would it be feasible to make the change optional? Sometimes, such as when testing in the context of a local development environment, you might validly want to just enter user@localhost.

Regards,

Nigel