Problem/Motivation
We should introduce a setting to make the top-level domain optional for email validation. Currently, a lot of modules (e.g. https://www.drupal.org/project/commerce_paypal) require the email form_element, to validate whether a given email-address has a top-level domain set or not.
But as it stands, the email validation allows emails without a top-level domain. This is fine according to https://datatracker.ietf.org/doc/html/rfc5321#section-2.3.5, but in 99% of all uses cases the top level domain should be a required component of an email-address (intranets etc. being the exception).
Therefore, we should add a setting where this is configurable
Steps to reproduce
- Go to any form containing a form_element with an email field (type "email").
- Type in any email address without a top-level domain (e.g. "max.mustermann@test")
- Submit the form.
- No validation error appears.
Proposed resolution
Introduce a setting to make the top-level domain optional for email validation, and write an update hook enabling this setting for existing installations.
Comments
Comment #2
oadaeh commentedWhat about user@localhost?
According to 2.3.5. Domain Names of RFC 5321 (which is referenced from 3.4.1. Addr-Spec Specification of RFC 5322):
It may not be valid on the Internet, but it might still be a valid domain on an intranet or localhost, and therefore, should not be disallowed.
Comment #3
jnicola commentedHmm, okay I suppose I hadn't considered the intranet bit.
Welp, looks like I won't be leveraging core on this email check then as it's not all that useful!
Comment #4
CatsFromStonehenge commentedThis is the problem with validation of user inputs. Email validation is an age old classic. If we go 100% with the official specification, then it can be either too strict or too loose, depending on what we want.
In Oadaeh's case the email validator isn't useful. I wonder if we should allow some configuration of the built-in email validator? e.g. to allow intranet or not etc.
Here's an in-depth take on using regular expressions for email validation:
http://www.regular-expressions.info/email.html
Comment #5
CatsFromStonehenge commentedCheck out the PHP function:
filter_var($email, FILTER_VALIDATE_EMAIL)https://secure.php.net/manual/en/filter.filters.validate.php
Regarding "partial" addresses with no . in the domain part, a comment in the source code (in ext/filter/logical_filters.c) justifies this rejection thus:
Comment #6
cilefen commentedFWIW Drupal 8 uses https://github.com/egulias/EmailValidator
Comment #7
CatsFromStonehenge commentedThanks @cilefen. That's good to know :)
Comment #8
dmezquiaI fixed with custom code like this:
Comment #9
nigelcunningham commentedIf you want the option of rejecting non routable addresses (fred@localhost), you want the patch in https://www.drupal.org/project/webform/issues/3173490, which optionally does additional checking on top of what the core validator does.
Comment #10
liquidcms commentedCurious why the default email validation fails: "Tom Smith" even though this is valid and the Drupal mail system supports this.
Comment #11
andreasderijckeA new module to make this configurable: https://www.drupal.org/project/evac
Comment #12
magendiran commentedThanks @dmezquia
Comment #13
cilefen commentedComment #14
grevil commented@andreasderijcke great module, thanks for your work! 🎉
Comment #15
grevil commentedIMO this issue should be reopened. Apart from https://www.drupal.org/project/commerce_paypal, there are / will be a lot of contrib modules, which require an e-mail adress to have a top-level-domain. And I don't think the modules itself should add this validation.
We should introduce a setting, to make the top-level domain optional for email validation. I adjusted the issue summary accordingly.
Comment #16
anybodyFrom my opiniton this would be a perfect example for a settings.php setting in core which can be overridden... but let's see what the others think.