Update regexp pattern to safer one (#12104)

Fixes: https://github.com/vaadin/framework/issues/7757

diff --git a/server/src/main/java/com/vaadin/data/validator/EmailValidator.java b/server/src/main/java/com/vaadin/data/validator/EmailValidator.java
index 63cd0211a27751c4ec1e1b243f31c660c27ce947..4d1a5406be60ac33c41078faabd7548aa04fd2b0 100644 (file)
--- a/server/src/main/java/com/vaadin/data/validator/EmailValidator.java
+++ b/server/src/main/java/com/vaadin/data/validator/EmailValidator.java
@@ -34,6 +34,12 @@ package com.vaadin.data.validator;
 @SuppressWarnings("serial")
 public class EmailValidator extends RegexpValidator {
 
+    private static final String PATTERN = "^" + "([a-zA-Z0-9_\\.\\-+])+" // local
+            + "@" + "[a-zA-Z0-9-.]+" // domain
+            + "\\." + "[a-zA-Z0-9-]{2,}" // tld
+            + "$";
+
+     
     /**
      * Creates a validator for checking that a string is a syntactically valid
      * e-mail address.
@@ -42,7 +48,6 @@ public class EmailValidator extends RegexpValidator {
      *            the message to display in case the value does not validate.
      */
     public EmailValidator(String errorMessage) {
-        super("^([a-zA-Z0-9_\\.\\-+])+@(([a-zA-Z0-9-])+\\.)+([a-zA-Z0-9]{2,4})+$",
-                true, errorMessage);
+        super(PATTERN, true, errorMessage);
     }
 }

diff --git a/server/src/test/java/com/vaadin/tests/data/validator/EmailValidatorTest.java b/server/src/test/java/com/vaadin/tests/data/validator/EmailValidatorTest.java
index 97d304d7df33aa1d3d4fa4330df6ffeb3804186a..d9004f59b0b51822babdbffbdac4f47154f26a17 100644 (file)
--- a/server/src/test/java/com/vaadin/tests/data/validator/EmailValidatorTest.java
+++ b/server/src/test/java/com/vaadin/tests/data/validator/EmailValidatorTest.java
@@ -28,4 +28,10 @@ public class EmailValidatorTest {
     public void testEmailValidatorWithOkEmail() {
         Assert.assertTrue(validator.isValid("my.name@email.com"));
     }
+
+    @Test
+    public void testEmailValidatorWithBadInput() {
+        Assert.assertFalse(validator.isValid("a@a.m5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZ&"));
+    }
+
 }