sahvx655-wq opened a new pull request, #437: URL: https://github.com/apache/commons-validator/pull/437
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project. - [x] Read the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) if you use Artificial Intelligence (AI). - [x] I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute? Claude Code (Anthropic) helped investigate the behaviour and draft the change and the test; I reviewed, ran and verified all of it before submitting. - [x] Run a successful build using the default [Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command line by itself. - [x] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. - [x] Each commit in the pull request should have a meaningful subject line and body. `EmailValidator.isValidDomain` matches a bracketed host with `IP_DOMAIN_REGEX`, whose address group is `(.*)`, and passes a tagged literal straight to `InetAddressValidator.isValidInet6Address`. That validator is general purpose and deliberately strips a trailing zone id (`%eth0`) and a CIDR prefix length (`/64`) before checking the address, so `isValid("user@[IPv6:fe80::1%eth0]")`, `isValid("user@[IPv6:2001:db8::1/64]")` and `isValid("user@[IPv6:::1/128]")` all return true. I noticed it while tracing the `IPv6:` tag handling from #428 through to the address check: RFC 5321 section 4.1.3 builds `IPv6-addr` from hex groups, `:` and the embedded IPv4 dotted form only, with no zone or prefix production, so none of those literals can name a mailbox host. Left as it is, an address that passes validation can carry a literal that a conformant SMTP parser refuses outright. The IPv4 branch is unaffected because `isValidInet4Address` is a strict regex. The fix stays in the regex, as asked on #428: the address group becomes `[0-9a-fA-F:.]+`, the same class `UrlValidator` already uses for a bracketed IPv6 host, so a literal carrying `%` or `/` no longer matches the address-literal pattern and drops through to the symbolic-domain check, which rejects it. The tagged forms, including the embedded IPv4 form, parse exactly as before, and `InetAddressValidator` keeps its zone and prefix support for callers that want it. The regression test fails on master at its first assertion and passes with the change; the full default Maven goal with `-Ddoclint=all` is green (3300 tests, checkstyle, PMD, SpotBugs and japicmp clean). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
