tracker issue : CF-3345191

select a category, or use search below
(searches all categories and all time range)

isValid 'Email' validation allows underscores in email form

| View in Tracker

Status/Resolution/Reason: Closed/Withdrawn/Duplicate

Reporter/Name(from Bugbase): Kevin Kerr / Kevin Kerr (kevink23)

Created: 10/11/2012

Components: Language, Framework Support

Versions: 10.0

Failure Type:

Found In Build/Fixed In Build: Final /

Priority/Frequency: Major / All users will encounter

Locale/System: English / Win 2008 Server R2 64 bit

Vote Count: 1

Duplicate ID:	CF-3231157

Problem Description: The isValid function for type "email" allows underscores in email address domain names, it should not.

Steps to Reproduce: IsValid('email', '');  

Actual Result: Return True;

Expected Result: Return False;

Any Workarounds:

----------------------------- Additional Watson Details -----------------------------

Watson Bug ID:	3345191

External Customer Info:
External Company:  
External Customer Name: kevink23
External Customer Email:  
External Test Config: My Hardware and Environment details:



This is particularly problematic as the 'to' attribute for <cfmail> errors out on an underscore in an email address.
Comment by External U.
17592 | October 11, 2012 04:38:19 PM GMT
underscores in domains are acceptable. See all the answers here:
Comment by External U.
17593 | May 28, 2013 03:30:56 AM GMT
Agree with kevink23 - the isValid test for email should not pass an address that will cause an error when used in the cfmail tag.
Comment by External U.
17594 | September 03, 2013 09:00:14 AM GMT
Agree with kevink23 - the isValid test for email should not pass an address that will cause an error when used in the cfmail tag.
Vote by External U.
17603 | September 03, 2013 09:00:41 AM GMT
Underscores for domains may be acceptable, but it doesn't appear to be advisable or currently allowable. Network Solutions won't let you register a domain name with underscores (letters, numbers or dashes only.) GoDaddy doesn't indicate that there's any problem, but silently strips the underscore after submission. Sub-domains can have underscores, but that's not the same thing as a registrable domain name (the identifier of a resource in a DNS database). WARNING: If the host or subdomain part of the url contain an underscore, IE cannot write cookies. Here's a related ColdFusion 9 bug that was reported 2 years prior to CF10 being released, migrated to bugbase as a CF10 bug and just recently flagged as "fixed". I'm hoping Adobe acts in good faith and fixes this bug in ColdFusion 9 too. (NOTE: isValid("variableName") doesn't work on CF9/10 either as it accepts values with spaces as valid ColdFusion variable names.)
Comment by External U.
17595 | September 27, 2013 11:50:16 AM GMT
Hello, I'm not sure I understand the status of this bug. Is it supposed to be fixed or open? I'm running into this discrepancy between cfmail and isvalid and I'm having to code around it. It makes the isvalid check useless.
Comment by External U.
17596 | November 23, 2013 08:16:31 PM GMT
Here is the bug lifecycle . Logged -> verified -> fixed -> tested -> closed. Right now, it is fixed and will closed after the fix is tested.
Comment by Rupesh K.
17597 | November 29, 2013 12:45:06 AM GMT
@Rupesh: Thank you. Once tested, it gets included in the following update, correct? It is not now integrated into Coldfusion.
Comment by External U.
17598 | November 29, 2013 08:43:56 AM GMT
What's the fix here? Allowing underscores, or making the thing work according to the spec? I'm presuming (can't be bothered checking) that Jamo is correct in that underscores are allowed in subdomains, but not TLDs? And at the very least do isValid() and <cfmail> agree now? I think the most correct answer would be to follow the various RFCs (SMPT, email address, domain names, etc), rather than somone's idea of a convention. But whatever the solution, it should be reflected uniformly throughout CFML. -- Adam
Comment by External U.
17599 | November 29, 2013 09:43:36 AM GMT
The ticket that this has been closed as a duplicate of isn't really the same. The other one is just about the local part of the email address (the bit before the @), whereas this one is about the domain name. Are you sure the other one covers the issue here? -- Adam
Comment by External U.
17600 | February 25, 2014 05:03:51 AM GMT
Adobe, hello? -- Adam
Comment by External U.
17601 | March 18, 2014 07:53:11 AM GMT
Hmm.. just passing thru. Noticed all the repeat asks for clarification, and no response from Adobe.. Okay.. continuing on my way.. :)
Comment by Aaron N.
17602 | May 19, 2017 06:39:01 AM GMT