Validate email on signup

[mickvandijke]

User emails are not properly validated on signup. I could sign up using ‘test@test’ whereas it should be ‘test@test.com’.

[josecelano]

Hi @WarmBeer, why does this have the "bug" label? What is the problem?

[mickvandijke]

Hi @WarmBeer, why does this have the "bug" label? What is the problem?

Sorry, I have updated the description.

[josecelano]

I've added basic validation in the frontend on this PR (using input type email).

[josecelano]

It seems @WarmBeer already fixed this in this commit d30fd46 on Mon Aug 29, 2022.

Anyway, I think we could use this crate: https://github.com/johnstonskj/rust-email_address for some reasons:

• If the email is invalid, it explains why it's not.
• Email validation is complex, so it's better to use a third-party package.
• Regular expressions can be used for Denial of service attacks. See https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

[josecelano]

test@test

It seems test@test’ is indeed a valid email address, but its use is discouraged because the email is undeliverable.

See:

• https://github.com/johnstonskj/rust-email_address/blob/main/src/lib.rs#L866-L869
• https://www.icann.org/en/announcements/details/new-gtld-dotless-domain-names-prohibited-30-8-2013-en

We could anyway use the package and add an extra validation to avoid domains without the TLD part ("dotless domain names") if we do not want to accept them.

[josecelano]

Finally, I've used the third-party library but added an extra validation in order to explicitly not allow dotless domains.