firebase / firebase/firebase-admin-go

Email Validation func is Improper

Open
#351 4 comments 0 reactions 1 assignee Claimed by @lahirumaramba View on GitHub
api: auth api: core
Dominant language
Go
Stars
1.3k
Forks
274
Avg merge
10h 39m
Merged PRs (30d)
2

Description

### [REQUIRED] Step 2: Describe your environment

* Operating System version: Mac OS
* Firebase SDK version: v3.12.0
* Library version: v3.12.0 (? not sure which library do you mean here)
* Firebase Product: auth (auth, database, storage, etc)

### [REQUIRED] Step 3: Describe the problem

#### Steps to reproduce:

The email validation func checks if the split over `@` results in 2 parts:

https://github.com/firebase/firebase-admin-go/blob/32728b0fc9f9486276937d8f50cdf75485c1293c/auth/user_mgt.go#L461-L463

But this risks rejecting valid email address. These are all valid email addresses:

- Abc\\@def@example.com
- "Abc@def"@example.com
- "<\"@\\".!.#%$@example.com

which the library will reject. The recommendation per Stavros Korokithakis is to check if there's an @ symbol and try to send an email to it. If they click the validation link, then it's a real address. So replace the prior snippet with:

#### Relevant Code:

Current code:
https://github.com/firebase/firebase-admin-go/blob/32728b0fc9f9486276937d8f50cdf75485c1293c/auth/user_mgt.go#L461-L463

Suggested replacement:

```go
if !strings.Contains(email, "@") {
return fmt.Errorf("malformed email string: %q", email)
}
```

References:
- [I Knew How To Validate An Email Address Until I Read The RFC](https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/)
- [So you think you can validate email addresses](https://archive.fosdem.org/2018/schedule/event/email_address_quiz/)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.