Tighten parser email validation with regression tests

collectionparser/parser.py

@@ -16,19 +16,18 @@ from collectionparser.utils import PasswordType, filter_printable, find_files, s
 # Separators tried in order; the duplicate ',' of the original is dropped.
 VALID_SEPARATORS = (":", ";", " ", "\t", "  ", "   ", ", ", ",", ";;", "::")
 
-# Same shape as the old `validate_email` dependency: rejects '<', '/', '>' etc.
-_EMAIL_RE = re.compile(
-    r"^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*"
-    r"@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$",
-    re.IGNORECASE,
-)
+# Email check: word/hyphen/dot local part, dotted word/hyphen domain labels,
+# 2..8 char TLD. `re.ASCII` keeps `\w` to [A-Za-z0-9_], so symbol-laden junk
+# like `[email protected]` is rejected.
+_EMAIL_RE = re.compile(r"^[\w.-]+@([\w-]+\.)+[\w-]{2,8}$", re.ASCII)
 _IP_RE = re.compile(r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
 _HEX = frozenset(string.hexdigits)
 _HASH_TYPES = {32: PasswordType.MD5, 40: PasswordType.SHA1, 64: PasswordType.SHA256}
 
 
 def valid_email(candidate: str) -> bool:
-    return candidate.count("@") == 1 and _EMAIL_RE.match(candidate) is not None
+    """True for a plausible address (``^[\\w.-]+@([\\w-]+\\.)+[\\w-]{2,8}$``)."""
+    return _EMAIL_RE.match(candidate) is not None
 
 
 def password_type(password: str) -> PasswordType:

tests/parser_test.py

@@ -56,6 +56,11 @@ class ParserTest(unittest.TestCase):
         self.assertIsNone(p("no at sign at all"))
         self.assertIsNone(p("plain text line:with:colons"))
         self.assertIsNotNone(p("user%40domain.com:password"))  # %40 still becomes '@'
+        # Symbol-laden local parts are rejected by the strict ASCII regex.
+        self.assertIsNone(p("[email protected]:12abcd"))
+        self.assertIsNone(p("[email protected]:pw"))
+        self.assertIsNone(p("[email protected]:pw"))  # '+' not allowed by the regex
+        self.assertIsNotNone(p("[email protected]:pw"))
         self.assertIsNotNone(
             p("[email protected]:[email protected]:victory")
         )