Email pattern ReDoS

Question

I would like to verify that the input from the user complies to the format of email address (in Java application). On the following page there is verbose regex that should properly validate the email http://emailregex.com/ (RFC 5322 Official Standard).

(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])

If I validate regex through this online tool http://redos-checker.surge.sh/ it says that this regex is vulnerable to ReDoS.

Is this true. Could someone craft such pattern that it would halt the evaluation of this regex pattern? Or at least it would take more than 3s?

Is there some tool available that could craft input which could potentially break evaluation, based on the regex itself?

Answer 1

An mail is valid if it can be mailed

You should focus on sending an email to the user rather on a regex.

There are working email addresses that are technically invalid, and syntactically valid email addresses would still require to email the user to validate it.

When this was brought in the HTML standard, Aryeh Gregor did a check on Wikipedia users that had validated their accounts (i.e. the provided email worked), yet found that people did use all kinds of weird characters, so they basically stated that there would need to be an @.

They now expanded it a bit, I would recommend you to use their regex if you must, but a regex step should only serve to filter out basic mistakes. Don't try to make a full validation.

The best validation of email addresses is that the user is able to receive it there. A few checks that there is a domain, or that the domain exists can help detect errors early, but little more. I would recommend you to also check https://isemail.info/ for ideas. If someone signed up with a gmial.com email address, pretty sure it's a typo albeit that's a valid email and you can't really be sure they didn't actually provide it correctly.

If someone keen on morse code wanted to use the (technically invalid) [email protected] email address, why should you insist that they use the correct "..._-_.-_-.-._-.-_._-..-_-.-._...._.-_-._--._."@invalid-email.com instead?