tilde in email address not valid

[Arthur Blake]

The IsValid function says an email address that contains a tilde, such as "billy~b...@junk.org" is valid-- and it actually is valid according to internet RFCs (strange as it may seem), however the cfmail tag throws an exception when trying to send an email to such an address.

The exception says: "invalid definition for attribute to at tag mail"

I've tested this in Railo  3.2.1.000 final and Railo 3.3.4.003 final-- Can someone confirm or deny if this is broken in Railo 4 as well?

I know in the past Railo disallowed other valid characters such as the apostrophe (see https://issues.jboss.org/browse/RAILO-559) but I couldn't not find a record of the tilde ever being addressed.

Thanks

[AJ Mercer]

Railo 4.0.4.001 final

Railo 4.0.4.000 Error (application)
Message	attribute [to] of the tag [mail] is invalid
Detail	Invalid E-Mail Address definition (billy~b...@junk.org)
Stacktrace	The Error Occurred in  \\perwww01\websites\dev.psl.com.au\webroot\labs\railo\cfmail-tilde.cfm: line 1 1: <cfmail from="ajme...@gmail.com"  to="billy~b...@junk.org" subject="tilde test"> 2: test billy~b...@junk.org 3: </cfmail>

--
Need help right now? Why not have one of the Railo Team help you directly: http://www.getrailo.com/index.cfm/consulting/
---
You received this message because you are subscribed to the Google Groups "Railo" group.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--

AJ Mercer
<webonix:net strength="Industrial" /> | <webonix:org community="Open" />
http://twitter.com/webonix

Railo Community Manager

[AJ Mercer]

Updated Railo to 4.1

Railo 4.1.0.005 Error (application)

Message	attribute [to] of the tag [mail] is invalid
Detail	Invalid E-Mail Address definition (billy~b...@junk.org)

Stacktrace

The Error Occurred in

\\perwww01\websites\dev.psl.com.au\webroot\labs\railo\cfmail-tilde.cfm: line 1

1: <cfmail from="ajme...@gmail.com" cc="ame...@psl.com.au" to="billy~b...@junk.org" subject="tilde test">

2: test billy~b...@junk.org 3: </cfmail>

[Adam Cameron]

I investigated bungness like this from a ColdFusion perspective, but the results (and conclusions) mostly apply to Railo too:
http://adamcameroncoldfusion.blogspot.co.nz/2013/02/email-address-validation-1-in-series.html

(Just FYI, really)

--
Adam

[Igal @ getRailo.org]

IsValid() and the attribute validation of cfmail should be consistent.

if they are not, please open a ticket in the JIRA.

thanks,


Igal

[Arthur Blake]

On Tuesday, April 9, 2013 10:50:54 PM UTC-4, Adam Cameron wrote:

I investigated bungness like this from a ColdFusion perspective, but the results (and conclusions) mostly apply to Railo too:
http://adamcameroncoldfusion.blogspot.co.nz/2013/02/email-address-validation-1-in-series.html

(Just FYI, really)

--
Adam

Adam, love your blog post! The flip side of the coin I guess is, don't use a funky email address if you just want to get stuff done generally speaking (even if it's technically valid) because so many web sites and frameworks just plain get it wrong.

 

[Adam Cameron]

Yeah. Pragmatism reveals it's more often the case that I want someone's service than I am prepared to hold out whilst they get their email validation right. I *always* email sites who do it wrong. Generally I don't hear back, or their first-line-support-script-reading-monkey doesn't understand.

But, fuck it, I will persist on pointing out when people do it wrong.

Case in point here.

--
Adam

[Adam Cameron]

Or, perhaps, *here*.

--
Adam

[Arthur Blake]

I have filed https://issues.jboss.org/browse/RAILO-2381 and I really hope you guys take Adam's advice and either rip out the validation or make it as minimal as possible -- this is not the first time I and my colleagues have been bitten by Railo rejecting valid email addresses.

[Mark Drew]

Hmm.. then maybe (as Adam states) don't use an isValid for email addresses? Maybe the only validation for email addresses should be something like 

ListLen(email, "@") IS 2

But I understand that we use it in the CFMail tag. Doing a quick look up it seems we are using the javax.mail.internet.InternetAddress class to check out if the email is valid (since that is what will be sending it eventually). 

You can see the call here: https://github.com/getrailo/railo/blob/master/railo-java/railo-core/src/railo/runtime/net/mail/EmailNamePair.java#L106

Sincerely

Mark Drew

The Railo Company
Professional Open Source
skype: mark_railo ma...@getrailo.com
+44 7971 852296 http://www.getrailo.com

On 10 Apr 2013, at 12:06, Arthur Blake <arthur...@gmail.com> wrote:

I have filed https://issues.jboss.org/browse/RAILO-2381 and I really hope you guys take Adam's advice and either rip out the validation or make it as minimal as possible -- this is not the first time I and my colleagues have been bitten by Railo rejecting valid email addresses.

[Adam Cameron]

Don't get all OpenBD about things. If there's a function: it should work.

--
Adam

[Mark Drew]

Err, not sure of your reference  but whatever. 

I was agreeing with you in a way. And I thought instead of just answering I would have a look at the source code and see what is happening.

If we remove that check, I think there will be an error further down the line as the javax.mail.internet stuff will then throw it's own error … but I am not in the engineering team so I can't really answer, I was just trying to help Adam. No need to get insulting. 

Hence I just said that maybe the isValid('email') function (used elsewhere) should be changed to the one something like ListLen(email, "@") IS 2

. (which I presume is what you are alluding to in your post)  

Sincerely

Mark Drew

The Railo Company
Professional Open Source
skype: mark_railo ma...@getrailo.com
+44 7971 852296 http://www.getrailo.com

[Justin Mclean]

Hi,

Just for context - as I run into this the other day and it contains good advice.
http://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address

Justin

[Jean Moniatte]

The regex based UDF at http://www.cflib.org/index.cfm?event=page.udfbyid&udfid=216 has proven pretty reliable over the years for me.

Thanks,

Jean

--

Jean Moniatte

UGAL

je...@ugal.com

http://www.ugal.com

[Adam Cameron]

Don't get defensive Mark. There was no insult (and I can't even see where you found one? You ought to know by now that if I actually mean to be insulting, there'll be no confusing it as anything else).

Just read the words I actually typed in. That's all I meant.

The OpenBD reference (click the link, it'd be more clear) was just an off-hand observation, and reinforcing the idea of "if you've got a function than claims to do x, then it should do x" (a ref to isValid()).

Cheers.

--
Adam

[Justin Mclean]

HI,

> The regex based UDF at http://www.cflib.org/index.cfm?event=page.udfbyid&udfid=216 has proven pretty reliable over the years for me.

Read the stack overflow answer - there is no simple regular expression for this problem, unless perhaps you want to use this one :-)

http://ex-parrot.com/~pdw/Mail-RFC822-Address.html

Thanks,
Justin

[Adam Cameron]

Read the stack overflow answer

Why is it I get the impression the guy who provided the accepted answer had an erection whilst typing all that in?

[shudder]

--
Adam

 

[Jean Moniatte]

I know. I was just saying that it works good enough, unless you want to "fuck the flies" ("enculer les mouches", I am not sure of the proper English translation). :-)

Thanks,

Jean

--

Jean Moniatte

UGAL

je...@ugal.com

http://www.ugal.com

Justin

[Jean Moniatte]

Lol, because of the fly :-)

--

[Neil Huyton]

"Nitpick", a far more genteel expression :)

[Mark Drew]

You compared me to Alan Williamson. 

My response was an initial investigation into the implementation. 

Ignore me from this thread as I am not going to investigate further. 

Regards

Mark Drew

Sent from a mobile device

[James Kilford]

Ah! That makes much more sense!

[andreas]

bennadel has also an interesting blog post to email validation with similar topic. 

http://www.bennadel.com/blog/265-ColdFusion-Email-Validation-IsValid-And-CFMail-Errors.htm

regards.

[Michael Offner]

there are even more problems with email validation,then the following email address is completely valid.

michael@müller.ch (google:IDN or IDNA)

there are 2 problems with this:

- many mailservers reject this email adresses, even it is valid and exists!

- this is not supported with all top level domains!

BTW: when a email isValid, this does not mean that the email exists, then perhaps the function "isvalid" is used in progress to create email adresses.

Micha

2013/4/10 andreas <andreas...@gmail.com>

bennadel has also an interesting blog post to email validation with similar topic. 

http://www.bennadel.com/blog/265-ColdFusion-Email-Validation-IsValid-And-CFMail-Errors.htm

regards.

--

Need help right now? Why not have one of the Railo Team help you directly: http://www.getrailo.com/index.cfm/consulting/
---
You received this message because you are subscribed to the Google Groups "Railo" group.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--

/micha

Michael Offner CTO Railo Technologies GmbH

[Igal Sapir]

IMO our main issue is the restriction on the attribute validation of cfmail and its inconsistency with IsValid()

The immediate fix should be to run cfmail's validation through the same code that checks IsValid()

Igal

--
typos, misspels, and other weird words brought to you courtesy of my mobile device and its auto-(in)correct feature.

[AJ Mercer]

Maybe the error message should change from 'invalid email address' 

to something like 'Mail Server can not handle this email address'

[Igal @ getRailo.org]

the problem is that currently we don't pass the email to any mail server -- we simply kill it at cfmail's attribute validation.

if we will allow it to pass attribute validation (to be consistent with IsValid( type=email )) then the servers along the route will either process it or reject it according to their implementations.

the ones that reject it (probably many now, but less in the future) will respond with an error similar to the one you suggested.


Igal

[Adam Cameron]

Heh. TBH if someone compared me to Alan, I'd be flattered. He's a clued-up dude.

He's just got an "interesting" (and not inaccurate to say "slightly self-serving") attitude to OpenBD.

I wasn't drawing a parallel to him, per-se, anyhow, it was your comment suggesting not using isValid() for validating email messages sounded like his suggestion to not use isJson() for validating JSON (for much the same reason: the function not working properly).

Anyway, I think Igal's right in the chief thing to do is to make sure isValid() and <cfmail> are reading off the same page. However isValid() should also do a slightly better job of validating, IMO.

--
Adam

[Michael Offner]

agree, it not only should do a better job it should do a perfect job ;-)

Micha

2013/4/11 Adam Cameron <adamcamero...@gmail.com>

--
Need help right now? Why not have one of the Railo Team help you directly: http://www.getrailo.com/index.cfm/consulting/
---
You received this message because you are subscribed to the Google Groups "Railo" group.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Adam Cameron]

That'd be ideal, obviously, but as someone pointed out the regex to do a perfect job is a bit of a monster. That said, I've not looked at it, and dunno if it's correct. To me it seems too complicated for what it needs to do.

The rules for the local part (eg the john.smith bit from john....@example.com), seem simply. Either:
* any of a subset of characters, unless
* it's quoted, in which case it can be anything at all (bearing in mind embedded quotes need to be escaped)
* there's some bumpf about comments, too

This is not complicated, and doesn't need a 5000-char regex, surely?

And the rules for the domain part are simple (and well documented, so I won't both reciting them).

All the quoted / comments stuff aside, the minimum should be to respect all the valid chars in the local part of the address, which you're not doing now, and would be really easy.

Cheer Micha.

--
Adam

On Thursday, 11 April 2013 18:54:12 UTC+12, Michael Offner wrote:

agree, it not only should do a better job it should do a perfect job ;-)

Micha

2013/4/11 Adam Cameron <adamcamero...@gmail.com>

[Igal @ getRailo.org]

I propose a simple, effective, way to validate email addresses.  it is much more liberal than the current tests but can be improved for edge cases (comments welcome).

this is a proof of concept in cfml, to be rewritten in Java and added to the core:

    function isValidEmail( addr ) {

        if ( addr CT '@' ) {

            try {

                createObject( "java", "javax.mail.internet.InternetAddress" ).init( addr );
                return true;
            }
            catch ( ex ) {}
        }

        return false;
    }

attached test script produces the results below (++ green means valid; examples taken from Wikipedia (http://en.wikipedia.org/wiki/Email_address#Valid_email_addresses) and Ben Nadel's post that was mentioned earlier in this thread):

++     someone@zürich.ch

++     <someone@zürich.ch> "zyz 09812)(*"

++     <someone@zürich.ch> "Some One"

++     <someone@zürich.ch> Some One

++     <someone@zürich.ch> (Some One)

++     Some One <someone@zürich.ch>

++     "Some One" <someone@zürich.ch>

++     (Some One) someone@zürich.ch

++     user@[IPv6:2001:db8:1ff::a0b:dbd0]

++     us...@192.168.0.1

++     "very.unusual.@.unusual.com"@example.com

++     nicean...@example.com

++     very....@example.com

++     not~that~com...@example.com

++     a.little.len...@dept.example.com

++     disposable.style....@example.com

++     user@[IPv6:2001:db8:1ff::a0b:dbd0]

++     "much.more unusual"@example.com

++     "very.unusual.@.unusual.com"@example.com

++     "very.(),:;<>[]\".VERY.\"very@\\ \"very\".unusual"@strange.example.com

++     postbox@com (top-level domains are valid hostnames)

++     admin@mailserver1 (local domain name with no TLD)

++     !#$%&'*+-/=?^_`{}|~@example.org

++     "()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~.a"@example.org

++     " "@example.org

++     weird."but".ri...@example.com

++     user...@example.com

--     Abc.example.com

--     A@b@c...@example.com

--     a"b(c)d,e:f;g<h>i[j\k]l...@example.com

++     just"not"ri...@example.com

--     this is"not\all...@example.com

--     this\ still\"not\\all...@example.com

--     Some One someone@zürich.ch

--     <someone@zürich.ch> "zyz 09812)(*

--     <someone@zürich.ch> zyz 09812)(*

--     user@IPv6:2001:db8:1ff::a0b:dbd0

--     user@2001:db8:1ff::a0b:dbd0

--    

--     1

--     @

--     .ben

--     .

--     ...

--     -.-.ben

++     sa...@hotties.ben

++     mary...@equinox.ben

++     mrs....@teacup.ben

++     libby...@blondes.ben

++     d.d....@domain.ben

++     heather..rose@gotglue.ben

++     anne--...@hackley.ben

++     .anna.cooper.@hockeychicks.ben

++     -christ...@hollywoodhotties.ben

--     @campuscuties.ben

++     -...@justlegal.ben

++     .@swank.ben

++     3...@atatime.ben

++     /@punctuation.ben

++     *@punctuation.ben

++     ben&mo...@kittens.ben

++     sa...@hot-girls.ben

++     an...@got----blondes.ben

++     jes...@-cool-girl-.ben

++     ju...@cool.beans.ben

++     julia@brazil..buddies.ben

++     ka...@dorm.-.girls.ben

++     la...@-.ben

++     mich...@36-24-36.ben

++     kim...@ladies.who.smile.ben

++     ye@whatwhat

++     stacy@largeladies.4

++     ma...@totality.123

++     jen@toocute.z

++     j...@cutencurley.xy

++     p...@waycute.xyz

++     gi...@cowgirls.a4b

++     li...@lumpyladies.abcdef

++     ja...@ilikeemlarge.abcdefghij

EOF

the problems that I see at this point are:

xx     just"not"ri...@example.com -- according to Wikipedia should fail
xx     julia@brazil..buddies.ben  -- I'm not sure that two consecutive dots should be allowed in domain?


Igal

[Adam Cameron]

Igal, I think that's great.
Firstly it correctly validates far more patterns than the current solution does, plus you can simply refer back the Java docs for the situations in which it doesn't - strictly speaking - work. Not that this is a blame game, but it shifts any "limitations" onto the underlying Java engine, rather than it being a Railo issue.

But it works for almost everything, so is really good!

Cool.

--
Adam

On Friday, 12 April 2013 17:50:46 UTC+12, Igal wrote:

I propose a simple, effective, way to validate email addresses.  it is much more liberal than the current tests but can be improved for edge cases (comments welcome).

this is a proof of concept in cfml, to be rewritten in Java and added to the core:

    function isValidEmail( addr ) {

        if ( addr CT '@' ) {

            try {

                createObject( "java", "javax.mail.internet.InternetAddress" ).init( addr );
                return true;
            }
            catch ( ex ) {}
        }

        return false;
    }

attached test script produces the results below (++ green means valid; examples taken from Wikipedia (http://en.wikipedia.org/wiki/Email_address#Valid_email_addresses) and Ben Nadel's post that was mentioned earlier in this thread):

++     som...@zürich.ch

++     <som...@zürich.ch> "zyz 09812)(*"

++     <som...@zürich.ch> "Some One"

++     <som...@zürich.ch> Some One

++     <som...@zürich.ch> (Some One)

++     Some One <som...@zürich.ch>

++     "Some One" <som...@zürich.ch>

++     (Some One) som...@zürich.ch

++     user@[IPv6:2001:db8:1ff::a0b:dbd0]

++     us...@192.168.0.1

++     "very.u...@.unusual.com"@example.com

++     nicean...@example.com

++     very....@example.com

++     not~tha...@example.com

++     a.little.len...@dept.example.com

++     disposable.style.email.with+sym...@example.com

++     user@[IPv6:2001:db8:1ff::a0b:dbd0]

++     "much.more unusual"@example.com

++     "very.u...@.unusual.com"@example.com

++     "very.(),:;<>[]\".VERY.\"very@\\ \"very\".unusual"@strange.example.com

++     postbox@com (top-level domains are valid hostnames)

++     admin@mailserver1 (local domain name with no TLD)

++     !#$%&'*+-/=?^_`{}|~@example.org

++     "()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~.a"@example.org

++     " "@example.org

++     weird."but".ri...@example.com

++     user...@example.com

--     Abc.example.com

--     A...@b@c...@example.com

--     a"b(c)d,e:f;g<h>i[j\k...@example.com

++     just"not"ri...@example.com

--     this is"not\all...@example.com

--     this\ still\"not\\all...@example.com

--     Some One som...@zürich.ch

--     <som...@zürich.ch> "zyz 09812)(*

--     <som...@zürich.ch> zyz 09812)(*

--     user@IPv6:2001:db8:1ff::a0b:dbd0

--     user@2001:db8:1ff::a0b:dbd0

--    

--     1

--     @

--     .ben

--     .

--     ...

--     -.-.ben

++     sa...@hotties.ben

++     mary...@equinox.ben

++     mrs....@teacup.ben

++     libby...@blondes.ben

++     d.d....@domain.ben

++     heathe...@gotglue.ben

++     anne--...@hackley.ben

++     .anna.cooper.@hockeychicks.ben

++     -christina.cox-@hollywoodhotties.ben

--     @campuscuties.ben

++     -...@justlegal.ben

++     .@swank.ben

++     3...@atatime.ben

++     /@punctuation.ben

++     *@punctuation.ben

++     ben&...@kittens.ben

++     sa...@hot-girls.ben

++     an...@got----blondes.ben

++     jes...@-cool-girl-.ben

++     ju...@cool.beans.ben

++     ju...@brazil..buddies.ben

++     ka...@dorm.-.girls.ben

++     la...@-.ben

++     mich...@36-24-36.ben

++     kim...@ladies.who.smile.ben

++     ye@whatwhat

++     st...@largeladies.4

++     ma...@totality.123

++     j...@toocute.z

++     j...@cutencurley.xy

++     p...@waycute.xyz

++     gi...@cowgirls.a4b

++     li...@lumpyladies.abcdef

++     ja...@ilikeemlarge.abcdefghij

EOF

the problems that I see at this point are:

xx     just"not"ri...@example.com -- according to Wikipedia should fail

xx     ju...@brazil..buddies.ben  -- I'm not sure that two consecutive dots should be allowed in domain?

[andreas]

Thats really great and IMO that is how it should be!!!! I even wouldn't bother about any edge cases, just let java do the whole stuff. In case java doesn't do the email format validation job according to rfc, it's a java issue, not railos.

Best wishes!