sahvx655-wq opened a new pull request, #422:
URL: https://github.com/apache/commons-validator/pull/422
`testEmailWithControlChars` already asserts that control characters are
rejected in the local part, but it only exercises unquoted C0 and DEL. Reading
the local-part grammar, two other routes survive: the quoted-string production
allows `[^"]`, which admits any control character, so `"ab"@example.com`
validates; and the unquoted atom excludes controls through `\p{Cntrl}`, which
in Java is ASCII-only (`[\x00-\x1F\x7F]`), so the C1 block U+0080 to U+009F
passes, as does a backslash-escaped control via the `(\\.)` alternative.
The fix swaps that exclusion for `\p{Cc}`, the Unicode Control general
category covering C0, DEL and C1, and applies it to all three local-part
productions: the unquoted atom, its quoted-pair, and the quoted string. Keeping
the check in the grammar closes every route at once rather than leaving each
caller to pre-scan the address. The deprecated
`org.apache.commons.validator.EmailValidator` carries the same construct in
`isValidUser` and takes the identical change; left unfixed, a NUL or other
control byte rides through inside a value the caller treats as a validated
address.
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
- [ ] Read the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) if you use
Artificial Intelligence (AI).
- [ ] I used AI to create any part of, or all of, this pull request. Which
AI tool was used to create this pull request, and to what extent did it
contribute?
- [x] Run a successful build using the default
[Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command
line by itself.
- [x] Write unit tests that match behavioral changes, where the tests fail
if the changes to the runtime are not applied. This may not always be possible,
but it is a best practice.
- [x] Write a pull request description that is detailed enough to understand
what the pull request does, how, and why.
- [x] Each commit in the pull request should have a meaningful subject line
and body. Note that a maintainer may squash commits during the merge process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
