Doc #78958 [Com]: FILTER_VALIDATE_EMAIL fails on a long email address

From: Date: Sat, 14 Dec 2019 15:21:26 +0000
Subject: Doc #78958 [Com]: FILTER_VALIDATE_EMAIL fails on a long email address
References: 1  Groups: php.doc.bugs 
Request: Send a blank email to doc-bugs+get-17118@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=78958&edit=1

 ID:                 78958
 Comment by:         drtechno at mail dot com
 Reported by:        kaulkwappe dot php-bugs at prvy dot eu
 Summary:            FILTER_VALIDATE_EMAIL fails on a long email address
 Status:             Open
 Type:               Documentation Problem
 Package:            Filter related
 Operating System:   Debian Buster 10.2
 PHP Version:        7.3.11
 Block user comment: N
 Private report:     N

 New Comment:

But I would do a #define EMAIL_ADDR "@." so that the function would look like:
#define SAFE        "$-_.+"
#define EXTRA       "!*'(),"
#define NATIONAL    "{}|\\^~[]`"
#define PUNCTUATION "<>#%\""
#define RESERVED    ";/?:@&="
#define EMAIL_ADDR "@."
void php_filter_email(PHP_INPUT_FILTER_PARAM_DECL)
{const unsigned char allowed_list[] = LOWALPHA HIALPHA DIGIT EMAIL_ADDR;
filter_map map;
filter_map_init(&map);
filter_map_update(&map, 1, allowed_list);
filter_map_apply(value, &map);
}

This file (sanitizing_filters.c),has a lot of extra space characters. They should be removed so
white space injection isn't a possibility....


Previous Comments:
------------------------------------------------------------------------
[2019-12-14 15:11:06] drtechno at mail dot com

looking at the source code:
#define SAFE        "$-_.+"
#define EXTRA       "!*'(),"
#define NATIONAL    "{}|\\^~[]`"
#define PUNCTUATION "<>#%\""
#define RESERVED    ";/?:@&="

void php_filter_email(PHP_INPUT_FILTER_PARAM_DECL)
{

	const unsigned char allowed_list[] = LOWALPHA HIALPHA DIGIT
"!#$%&'*+-=?^_`{|}~@.[]";
	filter_map     map;

	filter_map_init(&map);
	filter_map_update(&map, 1, allowed_list);
	filter_map_apply(value, &map);
}

it appears to be not correct.... I would think it would be:

#define SAFE        "$-_.+"
#define EXTRA       "!*'(),"
#define NATIONAL    "{}|\\^~[]`"
#define PUNCTUATION "<>#%\""
#define RESERVED    ";/?:@&="

void php_filter_email(PHP_INPUT_FILTER_PARAM_DECL)
{
	/* Check section 6 of rfc 822 http://www.faqs.org/rfcs/rfc822.html */
	const unsigned char allowed_list[] = LOWALPHA HIALPHA DIGIT "@.";
	filter_map     map;

	filter_map_init(&map);
	filter_map_update(&map, 1, allowed_list);
	filter_map_apply(value, &map);
}

------------------------------------------------------------------------
[2019-12-13 19:49:23] requinix@php.net

Maybe NAB is a bit too aggressive a reaction.

The thing with SMTP is that servers do whatever they want. The standards themselves even acknowledge
this in a few places. So while 64 octets is supposed to be the maximum, the actual emailing industry
will kinda just do whatever it wants.

Some documentation about exactly what rules PHP uses to validate emails (and maybe URLs too?) would
be nice. More than just a link to an RFC. A summary of the rules enforced.
But I think the real bug here is with PHP's listserv. exim, I believe.

------------------------------------------------------------------------
[2019-12-13 18:46:14] kaulkwappe dot php-bugs at prvy dot eu

I think a strict mode would make sense since developers may want to

a) prevent users from entering a new, not RFC valid email address, but
b) also prevent pseudo false positives from foreign email addresses.

E.g. when an user answers an email the system would check if the recipient email address you entered
is valid; however, the replying user cannot influence its RFC validness because it is an foreign
email address. Not RFC conform, but still valid. But the same user may not choose a RFC invalid
email address if he wants to create an email alias for himself.

------------------------------------------------------------------------
[2019-12-13 17:52:58] cmb@php.net

While the documentation of FILTER_VALIDATE_EMAIL claims it would
validate against the syntax in RFC 822, that has obviously been
changed with the fix for bug #49576.

------------------------------------------------------------------------
[2019-12-13 15:48:26] kaulkwappe dot php-bugs at prvy dot eu

Seems then to be a bug of the PHP mailing lists (https://www.php.net/mailing-lists.php) since they
return such invalid email addresses.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=78958


--
Edit this bug report at https://bugs.php.net/bug.php?id=78958&edit=1

Thread (8 messages)

« previous php.doc.bugs (#17118) next »