Skip to content

fix(isFQDN): reject unpaired UTF-16 surrogates - #2889

Open
smoelius wants to merge 1 commit into
validatorjs:masterfrom
trail-of-forks:fix-isFQDN
Open

smoelius wants to merge 1 commit into
validatorjs:masterfrom
trail-of-forks:fix-isFQDN

Conversation

@smoelius

Copy link
Copy Markdown
Contributor

Following an internal review, we noticed that PR #2822 contained an incomplete fix. Specifically, it caused default isEmail validation to accept email addresses whose domains contain unpaired UTF-16 surrogates, such as user@\uD800.com. This PR addresses that.

Recall, PR #2822 made isByteLength tolerate unpaired surrogates. Before #2822, default isEmail validation threw URIError for these inputs. But with the change to isByteLength, execution reaches isFQDN which accepts unpaired surrogates.

The present PR causes isFQDN to reject unpaired surrogates, so affected email addresses return false without throwing, including when ignore_max_length is set to true. Valid surrogate pairs retain their existing behavior, and isByteLength continues to count unpaired surrogates as three bytes, matching the UTF-8 encoding of the replacement character (U+FFFD).

Regression tests cover both isFQDN and isEmail, with default options and ignore_max_length: true. The test cases include:

  • Rejection of lone high and lone low surrogates at the beginning, middle, and end of domain labels.
  • Rejection of unpaired surrogates adjacent to valid surrogate pairs.
  • Continued acceptance of ordinary Unicode domains and domains containing valid surrogate pairs.

@codecov

codecov Bot commented Sep 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (9ff3424) to head (a8c3632).

Additional details and impacted files
@@            Coverage Diff            @@
##            master     #2889   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2601    +2     
  Branches       658       659    +1     
=========================================
+ Hits          2599      2601    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant