email: validate with net/mail.ParseAddress #8

2026-09-07T12:23:07Z

claude commented

2026-09-07 12:23:07 +00:00

Replaces the RFC 5322 mega-regexp in email.go with net/mail.ParseAddress.

addr, err := mail.ParseAddress(value)
if err != nil || addr.Name != "" || addr.Address != value {
    return ErrInvalidEmail
}

Only a bare address passes — display names, angle brackets, trailing content and address lists are rejected via the Name/Address checks.

Behaviour change: ParseAddress doesn't require a dotted domain, so alice@localhost now validates. Stricter domain rules should be a separate explicit check.

Also rewrites FuzzEmail (which asserted every input is invalid — only passing because the seed corpus is empty) into no-panic / stable-verdict / expected-error-type checks. Ran clean for 15s of -fuzz locally; full go test ./... green.

Closes #7

🤖 Generated with Claude Code

Replaces the RFC 5322 mega-regexp in `email.go` with `net/mail.ParseAddress`. ```go addr, err := mail.ParseAddress(value) if err != nil || addr.Name != "" || addr.Address != value { return ErrInvalidEmail } ``` Only a bare address passes — display names, angle brackets, trailing content and address lists are rejected via the `Name`/`Address` checks. **Behaviour change:** `ParseAddress` doesn't require a dotted domain, so `alice@localhost` now validates. Stricter domain rules should be a separate explicit check. Also rewrites `FuzzEmail` (which asserted *every* input is invalid — only passing because the seed corpus is empty) into no-panic / stable-verdict / expected-error-type checks. Ran clean for 15s of `-fuzz` locally; full `go test ./...` green. Closes #7 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude added 1 commit 2026-09-07 12:23:07 +00:00

email: validate with net/mail.ParseAddress b47fc29e3c

Replace the RFC 5322 mega-regexp with net/mail.ParseAddress, which is the
standard library's address parser and far easier to audit. A bare address
is required: inputs with a display name, angle brackets, a comment, or
trailing content are rejected, as is an address list.

Behaviour change: ParseAddress does not require the domain to contain a
dot, so "alice@localhost" now validates. Layer Match or a DNS lookup on
top if a stricter domain is needed.

Also rewrites FuzzEmail, which previously asserted that *every* input is
invalid, into checks that Email never returns an unexpected error type,
never panics, and gives a stable verdict.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

claude referenced this pull request

2026-09-07 12:23:23 +00:00

Email() uses an unauditable mega-regexp; prefer net/mail #7

aneurin merged commit a992065d6c into main

2026-09-07 12:53:03 +00:00

aneurin deleted branch email-net-mail

2026-09-07 12:53:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: go/validate#8