Skip to content

Commit cf6de33

Browse files
fluentfuturefluentfuture
committed
discuss apache validator
1 parent 0ea74d9 commit cf6de33

1 file changed

Lines changed: 22 additions & 18 deletions

File tree

  • dot-parse/src/main/java/com/google/common/labs/email

‎dot-parse/src/main/java/com/google/common/labs/email/README.md‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,34 +9,35 @@ combinators. It serves as a lightweight and secure alternative to
99

1010
## 1. Feature & API Design Comparison
1111

12-
| Feature / Property | `EmailAddress` (Combinator) | `InternetAddress` (Jakarta Mail) | JMail |
13-
| :--- | :--- | :--- | :--- |
14-
| **Domain Mutability** | **Immutable Record** (Thread-safe, robust as Map keys) | ❌ **Mutable POJO** (Exposes setters, prone to side effects) | **Immutable Value Object** (Thread-safe) |
15-
| **Footprint & Deps** | **Zero external dependencies** (Uses `dot-parse` combinators) | ❌ **Heavy EE stack** (Transitive dependencies) | **Lightweight** (Minor standalone deps) |
16-
| **Value Extraction** | **Canonical** (Quotes stripped, escapes unescaped) | ⚠️ **Mixed** (Canonical personal name; raw local part) | ❌ **Raw** (Quotes and backslashes left intact) |
12+
| Feature / Property | `EmailAddress` (Combinator) | `InternetAddress` (Jakarta Mail) | JMail | Apache `EmailValidator` |
13+
| :--- | :--- | :--- | :--- | :--- |
14+
| **Domain Mutability** | **Immutable Record** (Thread-safe, robust as Map keys) | ❌ **Mutable POJO** (Exposes setters, prone to side effects) | **Immutable Value Object** (Thread-safe) | N/A |
15+
| **Footprint & Deps** | **Zero external dependencies** (Uses `dot-parse` combinators) | ❌ **Heavy EE stack** (Transitive dependencies) | **Lightweight** (Minor standalone deps) | **Lightweight** (Part of commons-validator) |
16+
| **Value Extraction** | **Canonical** (Quotes stripped, escapes unescaped) | ⚠️ **Mixed** (Canonical personal name; raw local part) | ❌ **Raw** (Quotes and backslashes left intact) | N/A |
1717

1818
---
1919

2020
## 2. RFC Compliance
2121

22-
| RFC Feature / Section | `EmailAddress` | `InternetAddress` (Jakarta Mail) | JMail |
23-
| :--- | :--- | :--- | :--- |
24-
| **`local-part@domain`** | **Compliant** | **Compliant** | **Compliant** |
25-
| **Quoted Local Parts** | **Compliant & Canonical** (Strips quotes; re-escapes on output) | **Compliant** | ⚠️ **Partially Compliant** (Fails to strip/unescape quotes) |
26-
| **Unquoted Display Names** | **Strictly Compliant** (Forbids special characters `()<>[]:;@\,"` to prevent spoofing) | ⚠️ **Lenient** (Allows special characters unquoted in display names) | ⚠️ **Lenient** (Allows special characters unquoted in display names) |
27-
| **Group Addresses** (RFC 822) | 🚫 **Intentionally Omitted** (Obsolete, rejected for security) | **Compliant** (Parses groups as `isGroup()`) | 🚫 **Intentionally Omitted** (Obsolete, rejected for security) |
28-
| **RFC 2047 Encoded Words** | 🚫 **Intentionally Omitted** (Preserved raw to prevent spoofing) | **Compliant** (Decodes automatically, posing security risks) | 🚫 **Intentionally Omitted** (Preserved raw to prevent spoofing) |
29-
| **Comments & Domain Literals** | 🚫 **Intentionally Omitted** (Legacy comments/IP domains skipped) | **Compliant** (Supports full legacy feature set) | 🚫 **Intentionally Omitted** (Legacy comments/IP domains skipped) |
22+
| RFC Feature / Section | `EmailAddress` | `InternetAddress` (Jakarta Mail) | JMail | Apache `EmailValidator` |
23+
| :--- | :--- | :--- | :--- | :--- |
24+
| **`local-part@domain`** | **Compliant** | **Compliant** | **Compliant** | **Compliant** |
25+
| **Quoted Local Parts** | **Compliant & Canonical** (Strips quotes; re-escapes on output) | **Compliant** | ⚠️ **Partially Compliant** (Fails to strip/unescape quotes) | ⚠️ **Partially Compliant** (Validates but cannot extract/strip quotes) |
26+
| **Unquoted Display Names** | **Strictly Compliant** (Forbids special characters `()<>[]:;@\,"` to prevent spoofing) | ⚠️ **Lenient** (Allows special characters unquoted in display names) | ⚠️ **Lenient** (Allows special characters unquoted in display names) | ❌ **Not Supported** (Rejects display names completely, returns `false`) |
27+
| **Group Addresses** (RFC 822) | 🚫 **Intentionally Omitted** (Obsolete, rejected for security) | **Compliant** (Parses groups as `isGroup()`) | 🚫 **Intentionally Omitted** (Obsolete, rejected for security) | ❌ **Not Supported** (Rejects completely) |
28+
| **RFC 2047 Encoded Words** | 🚫 **Intentionally Omitted** (Preserved raw to prevent spoofing) | **Compliant** (Decodes automatically, posing security risks) | 🚫 **Intentionally Omitted** (Preserved raw to prevent spoofing) | ❌ **Not Supported** (Rejects completely) |
29+
| **Comments & Domain Literals** | 🚫 **Intentionally Omitted** (Legacy comments/IP domains skipped) | **Compliant** (Supports full legacy feature set) | 🚫 **Intentionally Omitted** (Legacy comments/IP domains skipped) | ⚠️ **Partially Compliant** (Supports IP literals, rejects comments) |
3030

3131
---
3232

3333
## 3. Security & Hardening
3434

35-
| Attack Vector / Vulnerability | `EmailAddress` (Combinator) | `InternetAddress` (Jakarta Mail) | JMail |
36-
| :--- | :--- | :--- | :--- |
37-
| **Parsing Differentials** (Split Bug) | **Immune** (Strictly rejects unconsumed trailing characters) | ❌ **Vulnerable** (Silently discards trailing parts like `<a@b>c@d`) | **Immune** (Natively rejects) |
38-
| **Display Name Spoofing** (Phishing) | **Immune** (Strictly rejects unquoted `@` or `<` in display names) | ❌ **Vulnerable** (Decodes and accepts unquoted `@` and `<` in display names) | ❌ **Vulnerable** (Accepts unquoted `@` in display names) |
39-
| **Group Syntax Abuse** (List splitting) | **Immune** (obsolete RFC 822 group constructs are strictly rejected) | ❌ **Vulnerable** (Accepts group syntax, bypassing single-recipient controls) | **Immune** (Natively rejects groups) |
35+
| Attack Vector / Vulnerability | `EmailAddress` (Combinator) | `InternetAddress` (Jakarta Mail) | JMail | Apache `EmailValidator` |
36+
| :--- | :--- | :--- | :--- | :--- |
37+
| **Parsing Differentials** (Split Bug) | **Immune** (Strictly rejects unconsumed trailing characters) | ❌ **Vulnerable** (Silently discards trailing parts like `<a@b>c@d`) | **Immune** (Natively rejects) | ⚠️ **Vulnerable** (Does not parse; forces application to split naively) |
38+
| **Display Name Spoofing** (Phishing) | **Immune** (Strictly rejects unquoted `@` or `<` in display names) | ❌ **Vulnerable** (Decodes and accepts unquoted `@` and `<` in display names) | ❌ **Vulnerable** (Accepts unquoted `@` in display names) | N/A (Rejects all display names) |
39+
| **Group Syntax Abuse** (List splitting) | **Immune** (obsolete RFC 822 group constructs are strictly rejected) | ❌ **Vulnerable** (Accepts group syntax, bypassing single-recipient controls) | **Immune** (Natively rejects groups) | N/A (Rejects all group formats) |
40+
4041

4142
---
4243

@@ -82,6 +83,9 @@ combinators. It serves as a lightweight and secure alternative to
8283
> individual corrupt elements and continue parsing the rest of the list
8384
> cleanly.
8485
86+
* **Apache `EmailValidator`**: Same as JMail; has no support for list parsing.
87+
88+
8589

8690
### B. Lenient vs. Strict Parsing Modes
8791

0 commit comments

Comments
 (0)