express-openapi-validator icon indicating copy to clipboard operation
express-openapi-validator copied to clipboard

Email format validation does not accept non-ascii characters

Open g-radam opened this issue 2 years ago • 0 comments

OpenAPI schemas which specify a field that is of format "email" fails if the email address contains non-ascii characters.

AVJ Mentions support for Internationalized email addresses "idn-email" via the avj-2019 plugin, but I'm not sure if OpenAPI is using this. Also see: https://en.wikipedia.org/wiki/Email_address#Internationalization and https://github.com/luzlab/ajv-formats-draft2019

Reproduce Via: Schema:

emailAddress:
  type: string
  format: email
  description: An Email address
  example: [email protected]

Non-Ascii Email (notice the " i " looking letter is not ASCII in the local part"Maria"):

Marí[email protected] 

Yields result:

Bad Request: request/body/emailAddress must match format "email"
    at Object.POST-/api/v1/person-application/json (<project>/node_modules/express-openapi-validator/dist/middlewares/openapi.request.validator.js:118:31)
    at RequestValidator.validate (<project>/node_modules/express-openapi-validator/dist/middlewares/openapi.request.validator.js:44:41)
    at <project>/node_modules/express-openapi-validator/dist/openapi.validator.js:233:53
    at <project>/node_modules/express-openapi-validator/dist/openapi.validator.js:166:28
    at processTicksAndRejections (node:internal/process/task_queues:95:5)

I would assume this would pass validation.

To get this working, I simply overloaded the email format validator with:

OpenApiValidator.middleware({
        apiSpec: ...,
        formats: [
            // In-built email validation fails with unicode characters
            // See: https://en.wikipedia.org/wiki/Email_address#Internationalization
            {
                name: "email",
                validate: (email: string): boolean => {
                    return email.match(
                        /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
                    ) != null;
                }
            }
        ]
    }),

Email validation code yanked from stackoverflow: https://stackoverflow.com/questions/3844431/are-email-addresses-allowed-to-contain-non-alphanumeric-characters

g-radam avatar Dec 04 '23 12:12 g-radam