atlassian / atlassian/openapi-request-validator

format: email rejects RFC 5321 Mailbox values when the TLD is not recognized

Open
#28 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14
Forks
5
PR merge metrics
No merged PRs in 30d

Description

## Summary

`format: email` validation currently appears to reject email addresses whose domain has a syntactically valid top-level label but is not in the validator's recognized/IANA TLD list.

That seems stricter than the OpenAPI `email` format definition, which says that `email` is an email address as defined by the RFC 5321 `Mailbox` rule.

## Example

Schema:

```yaml
type: object
properties:
email:
type: string
format: email
required:
- email
```

Request body:

```json
{
"email": "alice@example.notarealtld"
}
```

Actual result: validation fails.

Expected result: this should pass `format: email` syntax validation, because the domain part is syntactically valid under RFC 5321:

```abnf
Mailbox = Local-part "@" ( Domain / address-literal )
Domain = sub-domain *("." sub-domain)
```

RFC 5321 does not require the final label to be present in the IANA root zone or in an implementation-maintained TLD list for the address to match the `Mailbox` grammar.

## Relevant code path

This seems to come from the Java validation stack rather than from OpenAPI itself:

* `openapi-request-validator-core/pom.xml` depends on `com.networknt:json-schema-validator`.
* NetworkNT’s `com.networknt.schema.format.EmailFormat` constructs:

```java
new IPv6AwareEmailValidator(true, true)
```
* `IPv6AwareEmailValidator` extends Apache Commons Validator’s `EmailValidator`.
* Apache Commons `EmailValidator.isValidDomain(...)` delegates to `DomainValidator`.
* `DomainValidator.isValid(...)` checks that the domain has a recognized top-level domain via `isValidTld(...)`.
* `DomainValidator` documents this as validation of TLDs “as defined and maintained by the Internet Assigned Numbers Authority (IANA).”

## Why this matters

This makes `format: email` unsuitable for some valid API inputs, including internal/test/private domains (with local DNS resolution).

## Suggested fix

Please consider to configure the underlying email validator so `format: email` checks RFC 5321 `Mailbox` syntax without requiring a recognized/IANA TLD.

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with openapi-request-validator-core/pom.xml and trace the format: email path through NetworkNT's EmailFormat, IPv6AwareEmailValidator, Apache Commons EmailValidator, and DomainValidator. Verify the current behavior for syntactically valid domains with unrecognized TLDs, then define coverage showing that RFC 5321 Mailbox syntax is accepted without an IANA TLD requirement.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.