firebase / firebase/firebase-admin-go
Email Validation func is Improper
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 274
- Avg merge
- 10h 39m
- Merged PRs (30d)
- 2
Description
### [REQUIRED] Step 2: Describe your environment
* Operating System version: Mac OS
* Firebase SDK version: v3.12.0
* Library version: v3.12.0 (? not sure which library do you mean here)
* Firebase Product: auth (auth, database, storage, etc)
### [REQUIRED] Step 3: Describe the problem
#### Steps to reproduce:
The email validation func checks if the split over `@` results in 2 parts:
https://github.com/firebase/firebase-admin-go/blob/32728b0fc9f9486276937d8f50cdf75485c1293c/auth/user_mgt.go#L461-L463
But this risks rejecting valid email address. These are all valid email addresses:
- Abc\\@def@example.com
- "Abc@def"@example.com
- "<\"@\\".!.#%$@example.com
which the library will reject. The recommendation per Stavros Korokithakis is to check if there's an @ symbol and try to send an email to it. If they click the validation link, then it's a real address. So replace the prior snippet with:
#### Relevant Code:
Current code:
https://github.com/firebase/firebase-admin-go/blob/32728b0fc9f9486276937d8f50cdf75485c1293c/auth/user_mgt.go#L461-L463
Suggested replacement:
```go
if !strings.Contains(email, "@") {
return fmt.Errorf("malformed email string: %q", email)
}
```
References:
- [I Knew How To Validate An Email Address Until I Read The RFC](https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/)
- [So you think you can validate email addresses](https://archive.fosdem.org/2018/schedule/event/email_address_quiz/)
Contributor guide
Assessment
This issue has not been assessed yet.