Email validation treats emails as valid even if they are not

[stefanbauer]

• Laravel Version: 5.8.4
• PHP Version: 7.2.7

Description:

Not sure if that is Laravel related, but I guess. If you use the Laravel validator email constraint, it treats an invalid email like something@something as valid. I also tested it with Laravel 5.7. There it works as expected.

I know, that email validation has been updated in 5.8. But as I wrote on Twitter, this kind of validation doesn't make sense anymore then imho, because what does it check at the end? Imho nothing. Other thoughts on that?

Steps To Reproduce:

$validator = Validator::make(['email' => 'something@something'], [
    'email' => 'required|email',
]);

dd($validator->fails()); // returns false, which is not correct

$validator = Validator::make(['email' => 'something'], [
    'email' => 'required|email',
]);

dd($validator->fails()); // returns true, which is correct

[devcircus]

Not a laravel issue. that is technically a valid email address. Check the rfc for mailbox and address.

Notice that if you tell the browser to validate the email address, it will also pass.

[arjasco]

I posted about this 4 days ago - laravel/ideas#1555

I suspect this to come up more frequently as developers begin to adopt 5.8

Mailgun, SES etc would all reject these emails. I'm sure the audience thats running their own mail server is also quite slim. Just seemed more sense to me to actually extend the validator and use this library if you need it without it being default functionality.

A quick search around about valid email addresses and almost in all cases this crops up: "ICANN highly discourages dotless email addresses"

Try signing up to any major SaaS application with hello@something and see if it lets you...

As said in my post in ideas, yes it's valid.. but highly unusual, surely a practicality element has to be considered here, not just because the RFC's say so.

[devcircus]

The validation is "is this a valid email". Laravel shouldn't make the decision to block valid emails because they're in a format that is rarely used, or only used in certain cases. This is the perfect case for a custom validation if this is important in your app.

Possibly there could be a second email validation added to Laravel for the "common" email case, but the default email validation should remain as-is, IMO.

Unless you're actually pinging the email during validation, there's nothing ensuring a legitimate email address anyway, although there are several packages available that do this exact thing.

[laurencei]

As others have pointed already, although unusual, something@something is technically valid, so it's not a bug.

Unfortunately this GitHub area is not for ideas, suggestions etc. This is only for issues/bugs with the framework code itself. I will be closing your ticket here. You are able to open a ticket at https://github.com/laravel/ideas if you would like to propose alternatives.

Ultimately, even if they put a more traditional syntax like something@something.fake - that's not more/less likely to be true than the other example. Unless you do email validation, there is no way to be sure.

[cotiga]

Must stop the delirium!
It's not because the standard doesn't require the .TLD, that you must apply it. It is a matter of common sense.
Please, put the validation as under 5.7 and stop messing !!!

[ludo237]

@cotiga just create a custom rule. It's so easy to do 😕

Why do you always expect "the framework to do stuff" jeez

[robert-moore96]

the answer here imo is to add your own validation rule which has the rules you want.

other than sending a verification link to the given email there is no real way of knowing that an email address is valid and correct.

me@unregistered-domain is no less valid than me@unregistered-domain.com

[cotiga]

I completely understand what you are saying.
But here, I do not think about what the RFC says, I think validation of the visitors emails address.
The validation must verify the syntax of the email address, this is what has been done for 20 years by a "normal" email address validation scripts.
Today I am told that an address is valid without TLD! OK, I must be too old to understand this kind of nonsense.
Claudio, if I use a framework, it is precisely for not to have to "overecode" this kind of nonsense (which worked well until v5.7)

[robert-moore96]

Today I am told that an address is valid without TLD

email addresses dont have to have a tld to be valid.

maybe they do for whatever mail provider your choosing to use, but that is because they are adding tighter restrictions, which you are also able to do

[pixelplant]

By the way, this case also does not fail, while this is an invalid address:

$validator = Validator::make(['email' => 'invalid @gmail.com'], [
    'email' => 'required|email',
]);

dd($validator->fails()); // returns false, which is incorrect

So if you place a space right before the @, if does not fail, while space is not allowed in email adresses.

But if I test with

$validator = Validator::make(['email' => 'invalid email@gmail.com'], [
    'email' => 'required|email',
]);

dd($validator->fails()); // returns true, which is correct

the validation fails. so as long as the space is anywhere in the text but not right before the @, the validation is correct.

[devcircus]

Again, spaces are allowed in the local part of the address. Most providers don't allow it but it is a valid email.