GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix(forms): make the email() validator linear-time (#265) · bQuery/bQuery@5031c31

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • src/forms
    • validators.ts
  • tests
    • forms.test.ts
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎src/forms/validators.ts‎

Copy file name to clipboardExpand all lines: src/forms/validators.ts
+12-1Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,9 @@ export const pattern = (regex: RegExp, message = 'Invalid format'): SyncValidato
125125
};
126126
};
127127

128+
/** Longest address {@link email} accepts (RFC 5321 forward-path limit). */
129+
const MAX_EMAIL_LENGTH = 254;
130+
128131
/**
129132
* RFC 5322–simplified email validation.
130133
*
@@ -143,10 +146,18 @@ export const pattern = (regex: RegExp, message = 'Invalid format'): SyncValidato
143146
export const email = (message = 'Invalid email address'): SyncValidator<unknown> => {
144147
// Intentionally simple — covers the vast majority of valid addresses
145148
// without re-implementing the full RFC 5322 grammar.
146-
const re = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
149+
//
150+
// The domain is written as dot-separated labels that cannot contain a dot
151+
// themselves. The previous `[^\s@]+\.[^\s@]+` let both sides of the dot
152+
// match dots too, so a long run of dots after the `@` backtracked
153+
// quadratically (~5 s for 50 KB). Here every split is unambiguous, so the
154+
// match is linear; it also rejects empty labels (`[email protected]`, `[email protected]`).
155+
const re = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
147156
return (value: unknown) => {
148157
const str = typeof value === 'string' ? value : String(value ?? '');
149158
if (str === '') return true; // empty is handled by `required`
159+
// RFC 5321 caps a forward path at 254 octets; nothing longer is deliverable.
160+
if (str.length > MAX_EMAIL_LENGTH) return message;
150161
return re.test(str) ? true : message;
151162
};
152163
};
Collapse file

‎tests/forms.test.ts‎

Copy file name to clipboardExpand all lines: tests/forms.test.ts
+22Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,28 @@ describe('forms/validators', () => {
167167
const v = email('Bad email');
168168
expect(v('bad')).toBe('Bad email');
169169
});
170+
171+
it('rejects empty domain labels', () => {
172+
expect(validate('[email protected]')).toBe('Invalid email address');
173+
expect(validate('[email protected]')).toBe('Invalid email address');
174+
expect(validate('[email protected].')).toBe('Invalid email address');
175+
expect(validate('[email protected]')).toBe(true);
176+
});
177+
178+
it('rejects addresses longer than 254 characters', () => {
179+
const local = 'a'.repeat(64);
180+
const domain = `${'b'.repeat(60)}.`.repeat(4) + 'com';
181+
expect(validate(`${local}@${domain}`)).toBe('Invalid email address');
182+
expect(validate(`${local}@${'b'.repeat(60)}.com`)).toBe(true);
183+
});
184+
185+
it('returns quickly on adversarial input (#252)', () => {
186+
const start = performance.now();
187+
expect(validate(`a@${'.'.repeat(50_000)}@`)).toBe('Invalid email address');
188+
expect(validate(`a@${'.'.repeat(250)}@`)).toBe('Invalid email address');
189+
expect(validate(`a@${'b.'.repeat(125)}@`)).toBe('Invalid email address');
190+
expect(performance.now() - start).toBeLessThan(100);
191+
});
170192
});
171193

172194
describe('url', () => {

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.