Email Validator bug

Django Internals
1

Hi there,

I was just using the email validator and tried to whitelist domains.
However, when using a wrong domain the validator didn’t raise an error.

I had a look to the source code and was a bit confused by the logic:

if domain_part not in self.domain_allowlist and not self.validate_domain_part(
    domain_part
):
    raise ValidationError(self.message, code=self.code, params={"value": value})

Shouldn’t the two statements be connected via or or am I misunderstanding the implementation?
At least it worked as I expected when I changed the and to an or.

If that’s the case, then this might be even be a security vulnerability if one can bypass a wrong domain simply by using a string that matches the standard regex.

2

Welcome @LarsCG !

I think you’re misunderstanding the purpose of the domain_allowlist.

From the docs at EmailValidator.allowlist:

Allowlist of email domains. By default, a regular expression (the domain_regex attribute) is used to validate whatever appears after the @ sign. However, if that string appears in the allowlist , this validation is bypassed.

In other words, the domain is identified as valid if it either passes the regex or is in the allowlist. The purpose of this validator is to allow domains that don’t pass the regex to be considered valid, not to limit the domain to what’s in the allowlist.

3

Hi @KenWhitesell ,

oh, I see.
I saw someone mention it as a whitelist but that’s not it. Thanks for clearing things up.