Email validation allows deprecated email addresses

Created on 25 April 2025, 3 months ago

Problem/Motivation

In some rare cases users enters accidenitaly(?) a space immediatele before the `@` sign in email addresses. This is RFC-compliant, but deprecated and triggers a warning in `Egulias\EmailValidator\Validation\RFCValidation->isValid`. So a email address like `mmbk @drupal.org` would be valid, but most servers do not handle it. Triggering an error error while sending the mail.

Steps to reproduce

Use any form that has a email field (for example the `/admin/config/system/symfony-mailer-lite/test` ) and enter a address containing a ` @` The mail transfer will fail.

(sorry for the german screenshot )

Proposed resolution

`egulias/email-validator` supports another validator `NoRFCWarningsValidation` that is doing the same validations and treats the warnings as errors, so a mail like this cannot be entered.

Remaining tasks

Basically the change is:

diff --git a/lib/Drupal/Component/Utility/EmailValidator.php b/lib/Drupal/Component/Utility/EmailValidator.php
index f1345d03b1..f86efa7411 100644
--- a/lib/Drupal/Component/Utility/EmailValidator.php
+++ b/lib/Drupal/Component/Utility/EmailValidator.php
@@ -4,7 +4,7 @@ namespace Drupal\Component\Utility;
 
 use Egulias\EmailValidator\EmailValidator as EmailValidatorUtility;
 use Egulias\EmailValidator\Validation\EmailValidation;
-use Egulias\EmailValidator\Validation\RFCValidation;
+use Egulias\EmailValidator\Validation\NoRFCWarningsValidation;
 
 /**
  * Validates email addresses.
@@ -27,7 +27,7 @@ class EmailValidator extends EmailValidatorUtility implements EmailValidatorInte
     if ($email_validation) {
       throw new \BadMethodCallException('Calling \Drupal\Component\Utility\EmailValidator::isValid() with the second argument is not supported. See https://www.drupal.org/node/2997196');
     }
-    return parent::isValid($email, (new RFCValidation()));
+    return parent::isValid($email, (new NoRFCWarningsValidation()));
   }
 
 }

User interface changes

NONE

Introduced terminology

NONE

API changes

NONE

Data model changes

NONE

๐Ÿ“Œ Task
Status

Active

Version

11.1 ๐Ÿ”ฅ

Component

mail system

Created by

๐Ÿ‡ฉ๐Ÿ‡ชGermany mmbk MeiรŸen

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @mmbk
  • ๐Ÿ‡ฉ๐Ÿ‡ชGermany mmbk MeiรŸen

    Sitenotes:
    - Actually I don't understand the reason why it's not allowed to pass other validators into the `isValid` method.
    - Maybe it's a good idea to make the validator configurable in the mailer settings?

    Differences between the validators found in my research:
    RFCValidation:
    Validates email addresses according to RFC 5322, including some edge cases and deprecated features, such as:
    Quoted strings
    Folding white space (FWS)
    Comments
    Space before the @ (technically valid per RFC but rarely supported)
    This validator returns emails as valid even if they include unusual but technically RFC-compliant formats. It may emit warnings, which are important if you want to avoid deprecated or problematic formats.

    NoRFCWarningsValidation:
    This is a stricter validator. It still uses RFC rules, but any format that triggers an RFC warningโ€”like a space before @โ€”is considered invalid.

  • @annmarysruthy opened merge request.
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    Can we get a test showing this problem

  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia prabha1997

    I have tested this locally and encountered the following issue:

    Configuration: /var/www/html/core/phpunit.xml.dist
    
    F                                                                   1 / 1 (100%)
    
    Time: 00:10.017, Memory: 4.00 MB
    
    There was 1 failure:
    
    1) Drupal\Tests\Core\Recipe\RecipeQuickStartTest::testQuickStartRecipeCommand
    Failed asserting that ' 0/16 [โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘]\n
    Installing Drupal\n
    \n
     5/16 [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘]\n
    Set up database\n
    \n
     7/16 [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘]\n
    Set up database\n
    \n
    10/16 [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘]\n
    Configure site\n
    \n
    In install.core.inc line 980:\n
                                                                                                                      \n
      The email address <em class="placeholder">drupal@localhost</em> is not valid. Use the format user@example.com.  \n
      The email address <em class="placeholder">admin@localhost</em> is not valid. Use the format user@example.com.   \n
                                                                                                                      \n
    \n
    quick-start [--langcode [LANGCODE]] [--password [PASSWORD]] [--site-name [SITE-NAME]] [--host [HOST]] [--port [PORT]] [-s|--suppress-login] [--] [<install-profile-or-recipe>]\n
    \n
    ' [UTF-8](length: 1108) contains "Congratulations, you installed Drupal!" [ASCII](length: 38).
    
    /var/www/html/core/tests/Drupal/Tests/Core/Recipe/RecipeQuickStartTest.php:119
    
    FAILURES!
    Tests: 1, Assertions: 2, Failures: 1.
  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia prabha1997

    Thank you for your feedback.
    I've now added the following assertion to cover the invalid email case with a space:
    $this->assertFalse($validator->isValid('example @example.com'));
    Please let me know if any further changes are needed.

  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    Thnk a last step would be to get a CR written as this could be a behavior change for some

Production build 0.71.5 2024