EmailValidator fails on valid email address (when IDN is enabled) and address contains .-

[ihitbuttons]

What steps will reproduce the problem?

Validate any (valid) email address with .- in the address, and set enableIDN to true.
i.e. user.-name@domain.com (this is a valid email address).

What is the expected result?

The email will validate.

What do you get instead?

The email fails validation.

Additional info

I traced this problem down. What happens is in framework/validators/EmailValidator.php, line 80
$matches['local'] = $this->idnToAscii($matches['local']);

The idnToAscii function returns false (because line 142 returns false). It seems that a string with .- in it will fail to convert to ascii in this function, causing valid email addresses to fail email validation.

This causes the email address to end up being (in the example above) @domain.com when re-assembled on line 81:
$value = $matches['name'] . $matches['open'] . $matches['local'] . '@' . $matches['domain'] . $matches['close'];

Q	A
Yii version	2.0.41.1
PHP version	7.4.16
Operating system	Linux

[bizley]

I'm not sure what we can do about it since it's idn_to_ascii that returns error with IDNA_ERROR_TRAILING_HYPHEN.

[Mister-42]

I can't confirm such an email address is valid under the RFC. Hyphens can't be the first or last character and a dot splits up the local part, making the second local part start with a hyphen.

Can anyone verify?

[diego-mathis]

idn_to_ascii is actually for the domain part, not the local.
I guess the question becomes what todo with the local part.

https://www.php.net/manual/en/function.idn-to-ascii.php

This function converts a Unicode domain name to an IDNA ASCII-compatible format.

[Mister-42]

idn_to_ascii is actually for the domain part, not the local.
I guess the question becomes what todo with the local part.

https://www.php.net/manual/en/function.idn-to-ascii.php

This function converts a Unicode domain name to an IDNA ASCII-compatible format.

Interesting, that is not how it is currently used, probably causing the issue.

[ihitbuttons]

I can't confirm such an email address is valid under the RFC. Hyphens can't be the first or last character and a dot splits up the local part, making the second local part start with a hyphen.

Can anyone verify?

I tracked down this issue from Craft CMS when an existing email address failed validation (the address works, and is a valid email address). The email was in the format of firstName.x.lastName.-nd@somedomain.com. Craft basically forces the enableIDN to true if the idn_to_ascii method exists, and the validation only fails when going through the idn_to_ascii method (the regex even allows for this combination of characters, it just gets removed when the method returns false).