Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by ComputerGuru on Tuesday December 17, 2019 @12:22AM
(#21810890)
> Edit: Sorry, there's quite a few asterisks in the regexes that Hacker News is turning into italicization, and I don't know how to unbork them.
Prefix the regex with four spaces.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by iudqnolq on Monday December 16, 2019 @11:51PM
(#21810714)
This is why I love HN. Someone replied to my joking improperly-researched comment with the right answer and a detailed explanation of why I'm wrong. I stand by my assertion that actually using that regex to check emails the user enters would be dumb.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by chupasaurus on Tuesday December 17, 2019 @12:16AM
(#21810844)
IDNs (Internationalized Domain Names) would blow any regexp to an infinity because the list of languages usable in different domains isn't unified[0]
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by jcranmer on Tuesday December 17, 2019 @12:34AM
(#21810945)
By the time you hit IDNs, regexes for validation are no longer your biggest issue. Your real check for validity at that point becomes "can I actually contact the host" (or send an email, if validating an email address), and there is little point in aggressively validating a purported domain name instead of checking if it actually exists.
An email address consists of a local-part, a literal @ character, and then a domain name or an IP address literal. The local-part is either a series of dot-separated atoms (/[a-zA-Z0-9!#$%&'+/=?^_`{|}~-]+/ is the syntax for an atom) or a quoted string (/"([^\\"\0-\031\x7f]|\\[^\0-\031\x7f])"/ in regex). If you support EAI, you need to add \u00a0-\u10ffff [i.e., all non-ASCII non-C1 control characters].
According to RFC 822, you can insert whitespace (and comments) arbitrarily into the mailbox production, but that is non-semantic. Seeing "From: John Doe <foo @ example (I ((hate)) CFWS).com>" means that the email address is exactly "[email protected]", and you can reject any claim of the spelling without prejudicing any email addresses.
In practice, you can drop all support for quoted strings and IP address literals in most applications. So a correct email address (pre-EAI) regex in that vein would be:
If you insist on quoted-string support, then it looks like this: [I simplified the quoted string to only accept escapes that are semantically necessary--the strings "a b"@example.com and "a\ b"@example.com correspond to the same email address].Edit: Sorry, there's quite a few asterisks in the regexes that Hacker News is turning into italicization, and I don't know how to unbork them.
Edit 2: Someone suggested how to unbork the standalone regexes, but the asterisks in the inline regex in the second paragraph are still missing.