EmailValidator with IDN fails on hyphen about validator HOT 11 CLOSED

It seems the problem is wider, [email protected] will also fail server side validation.
Note that client validation works...

from validator.

@samdark could you move this to Yii 3?

What about simplifying this validator to use filter_var for server side validation?

from validator.

Do these give us equal results?

from validator.

Definitely not equal, since the it allows the email address I mentioned in the original post. I'll run all emails from the test suite through it

from validator.

Also it doesn't support name inside the email; but we could add that.

from validator.

I'm looking into this a bit more; I feel this email is valid:

после-преобразования-в-idn-тут-будет-больше-чем-64-символа@пример.com

Currently it is not valid when encoding the local part of the email address using PunyCode.
However, according to specs the local part should be handled as opaque. Encoding it using punycode gives us no guarantee that the receiving server will put it in the correct mailbox.
Specifically RFC5336 (https://tools.ietf.org/html/rfc5336#section-3.2) explicitly mentions that the domain part needs to be encoded according to RFC3490 but doesn't mention the local part.

So in the example above, the domain is a valid IDN. The local part might require accepted a mail server that supports SMTPUTF8, but that's not the same as encoding the local part using PunyCode...

from validator.

https://tools.ietf.org/html/rfc3490#section-3.2.2

from validator.

I've created a proof of concept PR that has some failing tests.
Specifically the tests for the Swiftmailer CVE.

I'm not sure that it should be the default for an EmailValidator to check for email addresses that happen to be dangerous when paired with a bad implementation...

The vulnerability we are testing for was fixed in 2016 https://github.com/swiftmailer/swiftmailer/blob/41e285e7184aee087da882477173602281f00463/CHANGES#L96

Note that these email addresses are technically valid so they should be accepted.

from validator.

We can remove Swiftmailer-specific check, I think.

from validator.

See yiisoft/yii2#16961

from validator.

I sent a PR about this issue.

from validator.