Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Select view

Select search mode

 
11 of 11

isvalid('email',foo) sometimes throws instead of returning false

Fixed

Description

You'd be amazed what users manage to put into CSV files we see.

Example :

writeOutPut( isValid('email','foo@bar'&chr(8207) ) )

this throws java.text.ParseException rather than returning false.

Remove the chr() or use a number like '7' and it's fine. Note chr(7) is just as unprintable as whatever (unicode ?) is chr(8207).

isValid() is passed untrusted user input right, so any exceptions should be caught and turned into returning false ?

Environment

trycf.com

Details

Assignee

Reporter

Priority

Labels

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Affects versions

Created 16 August 2021 at 16:21
Updated 22 February 2022 at 09:31
Resolved 22 February 2022 at 09:31

Activity

Show:

Pothys - MitrahSoft22 February 2022 at 09:30

Pothys - MitrahSoft23 August 2021 at 06:59
Edited

This issue was fixed by the ticket LDEV-2491https://luceeserver.atlassian.net/browse/LDEV-2491 ticket's fix. Both issues were solved by this fix https://github.com/lucee/Lucee/pull/1511

Pothys - MitrahSoft17 August 2021 at 10:08

I've checked this ticket and confirmed this issue happened on lucee latest version 5.3.8.201-SNAPSHOT too. While validate mail using isValid(), If the input has chr(8207) means it throws an error like java. text.ParseException: A prohibited code point was found in the inputbar. Seems ACF returns false.

Stacktrace

lucee.runtime.exp.NativeException: java.text.ParseException: A prohibited code point was found in the inputbar‏ at java.net.IDN.toASCIIInternal(Unknown Source) at java.net.IDN.toASCII(Unknown Source) at java.net.IDN.toASCII(Unknown Source) at lucee.runtime.net.mail.MailUtil.fixIDN(MailUtil.java:221) at lucee.runtime.net.mail.MailUtil.parseEmail(MailUtil.java:199) at lucee.runtime.net.mail.MailUtil.isValidEmail(MailUtil.java:144) at lucee.runtime.op.Decision.isEmail(Decision.java:861) at lucee.runtime.op.Decision.isValid(Decision.java:1006) at lucee.runtime.functions.decision.IsValid.call(IsValid.java:54) at test.testcase.ldev3677.test_cfm$cf$1.call(/test/testcase/LDEV3677/test.cfm:2) at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1034) at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:926)

Flag notifications