203795 - bugzilla does not accept many valid email addresses

Status: RESOLVED WONTFIX

(Bugzilla :: User Accounts, defect)

Description

[William D. Colburn]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4a) Gecko/20030401
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4a) Gecko/20030401

While trying to report a mozilla bug I was unable to create an account to report
the bug.  I tried the following VALID email addresses, but was refused:
  [e-mail] with password "password"
  "@ @"@nmt.edu with password "password"

The second gave me an error indicating that "@" and "\"" are illegal in email
addresses, which is false, but did not say that "+" was illegal.  If you check
the RFCs you will find that both of the email addresses that I attempted to use
are legal and valid.  Ever since I posted to comp.risks using the second email
address ("@ @"@nmt.edu) I've gotten a fair amount of email from people trying it
out to see if it really works.

I sent email to someone directly, and they found that I had a bugzilla account
from long ago that was "[e-mail]" so I was able to reclaim that
one and submit my bug.

Reproducible: Always

Steps to Reproduce:
1. go to bugzilla.mozilla.com
2. try to create an account using a valid email address that contains +, @, ",
or any number of other legal characters
3.

Actual Results:  
With a "+" I get the unhelpfull error message "The username or password you
entered is not valid."

With other characters, I am told that "\ ( ) & < > , ; : " [ ], or any
whitespace." are invalid.  This is, of course, incorrect.  Technically (until
that new RFC passes) I can even have the NULL character in my username (although
no MTA has even been able to successfully implement that).

Expected Results:  
Mozilla should accept valid email addresses.

Comment 1

[Bradley Baetz (:bbaetz)]

We don't have the full rfc822 parser which would be needed for the second form.

The first should work, though, and you do have an email address with a + in it
now. Justdave, whats the email regexp on bmo?

Comment 2

[Dave Miller [:justdave]]

bbaetz: ^[^@, ]*@[^@, ]*\.[^@, ]*$

Comment 3

[Bradley Baetz (:bbaetz)]

I'm able to change my address to [e-mail] (on bmo), and thats the same
code.

Can you create an account with a + on http://landfill.bugzilla.org/bugzilla-tip?

Comment 4

[chaduv]

Successfully created account [e-mail] on bugzilla-tip.

The error message reported for creating an account with '+' in it can only 
occur when attempting to log in (or do something that requires being logged 
in), not in account creation. The second part: "@ @"@whatever.org is probably 
wontfix.

Given the summary, I recommend marking wontfix - because email addresses are 
embedded in many scripts (reports.cgi, for example), the characters blocked are 
reasonable.

Comment 5

[chaduv]

What's there works well enough. A site admin can change the regexp that is
accepted if they want.