Substring domain matching
-
I noticed the existing code in antideo-email-validator.php line 708 (domain blacklisting) does:
$black_listed = false; foreach($domain_blacklist as $key => $value){ if (stripos($value, $domain) !== false) { $black_listed = true; } }
This potentially could match a blacklist entry of foo.co if the email address was foo.co.uk because foo.co ($value) will be found within foo.co.uk ($domain). These should not match, however as they are different domains. Additionally, trying to blacklist a subdomain like foo.bar.com will accidentally catch ANY bar.com emails, because bar.com ($domain, the ‘needle’ in the search) does appear in foo.bar.com ($value, the ‘haystack’).
The solution would seem to be to do str_ends_with() instead of stripos(), to make sure that the blacklisted domain is found AT THE END of the string being tested, not anywhere within it. This would also allow for blacklisting of entire top level domains (like .xxx or .adult) to catch all domains within the TLD.
A potential implementation would look like
$black_listed = false; foreach($domain_blacklist as $key => $value){ if (str_ends_with($domain, $value) == true) { $black_listed = true; } }
- The topic ‘Substring domain matching’ is closed to new replies.