465248 - Ampersand ('&') is a legal character in email addresses, but Bugzilla doesn't respect this

Status: RESOLVED DUPLICATE of bug 279016

(Bugzilla :: User Accounts, defect)

Description

[Stewart Gordon]

Section 3.2.4 of RFC 2822 defines '&' to be a legal character in email addresses.  Nonetheless, Bugzilla rejects any email address containing such a character.

Steps to reproduce:
1. Visit https://landfill.bugzilla.org/bugzilla-tip/userprefs.cgi?tab=account
2. Enter under "New email address" a valid email address that contains a '&'
3. Press Submit Changes.

Actual results:
An error page is returned:
The e-mail address you entered (sm&[e-mail]) didn't pass our syntax checking for a legal email address. A legal address must contain exactly one '@', and at least one '.' after the @, a legal top-level domain after the last '.', and may not contain any commas or spaces. It must also not contain any of these special characters: \ ( ) & < > , ; : " [ ], or any whitespace.

Expected results:
Accept the email address.  And adjust the error message accordingly.

I have looked through the RFC and found the following:

all ASCII symbols: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
specials:           "     ()  , . :;< > @[\]
atext:             ! #$%&'  *+ - /   = ?    ^_`{|}~
Bugzilla rejects:   "   & ()  ,   :;< >  [\]

Notice that, apart from '.' and '@', which are structural parts of an email address, the only difference between 'specials' and the set that's rejected according to Bugzilla's error message is '&'.

Comment 1

[Stewart Gordon]

Submission of this seems to have brought out a related issue - when Bugzilla links email addresses, it assumes that any '&' is punctuation outside of the email address.

Comment 2

[Frédéric Buclin]

That's not the only one character we currently exclude from email addresses. Same root cause as bug 279016.