Changeset 62225

Timestamp:

04/11/2026 02:22:15 PM (6 months ago)

Author:

dmsnell

Message:

Email: Add unit tests covering email validation and sanitization.

In preparation for later work to allow non-US-ASCII email addresses, this change extends the unit test suite for is_email() and adds new tests covering antispambot() and sanitize_email().

This work was done collaboratively during WordCamp Vienna, 2026 as a Contributor Challenge in cooperation with and support from ICANN and also GeoTLDs Universal Acceptance Local Initiative.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11552
Discussed in: https://core.trac.wordpress.org/ticket/31992

Props agulbra, akirk, benniledl, dmsnell.
See #31992.

Location:

trunk/tests/phpunit/tests/formatting

Files:

• antispambot.php (added)
• isEmail.php (modified) (4 diffs)
• sanitizeEmail.php (added)

trunk/tests/phpunit/tests/formatting/isEmail.php

@@ -1 +1 @@
 <?php
-
 /**
+ * Tests for the is_email() function.
+ *
  * @group formatting
  *
@@ -7 +8 @@
  */
 class Tests_Formatting_IsEmail extends WP_UnitTestCase {
-
         /**
-         * @dataProvider valid_email_provider
+         * Ensures that valid emails are returned unchanged.
+         *
+         * @ticket 31992
+         *
+         * @dataProvider data_valid_email_provider
+         *
+         * @param string $email Valid email address.
          */
         public function test_returns_the_email_address_if_it_is_valid( $email ) {
-                $this->assertSame( $email, is_email( $email ), "is_email() should return the email address for $email." );
+                $this->assertSame(
+                        $email,
+                        is_email( $email ),
+                        'Should return the given email address unchanged when valid.'
+                );
         }
 
         /**
-         * Data provider for valid email addresses.
+         * Data provider.
          *
-         * @return array
+         * @return Generator
          */
-        public static function valid_email_provider() {
+        public static function data_valid_email_provider() {
                 $valid_emails = array(
                         'bob@example.com',
                         'phil@example.info',
+                        'phil@TLA.example',
                         'ace@204.32.222.14',
                         'kevin@many.subdomains.make.a.happy.man.edu',
                         'a@b.co',
                         'bill+ted@example.com',
+                        '..@example.com',
                 );
 
@@ -36 +48 @@
 
         /**
-         * @dataProvider invalid_email_provider
+         * Ensures that unrecognized email addresses are rejected.
+         *
+         * @ticket 31992
+         *
+         * @dataProvider data_invalid_email_provider
+         *
+         * @param string $email Invalid or unrecognized-to-WordPress email address.
          */
         public function test_returns_false_if_given_an_invalid_email_address( $email ) {
-                $this->assertFalse( is_email( $email ), "is_email() should return false for $email." );
+                $this->assertFalse(
+                        is_email( $email ),
+                        'Should have rejected the email as invalid.'
+                );
         }
 
         /**
-         * Data provider for invalid email addresses.
+         * Data provider.
          *
-         * @return array
+         * @return Generator
          */
-        public static function invalid_email_provider() {
+        public static function data_invalid_email_provider() {
                 $invalid_emails = array(
                         'khaaaaaaaaaaaaaaan!',
@@ -55 +76 @@
                         'bob@your mom',
                         'a@b.c',
+                        '" "@b.c',
+                        '"@"@b.c',
+                        'a@route.org@b.c',
+                        'h(aj@couc.ou', // bad comment.
+                        'hi@',
+                        'hi@hi@couc.ou', // double @.
+
+                        /*
+                         * The next address is not deliverable as described,
+                         * SMTP servers should strip the (ab), so it is very
+                         * likely a source of confusion or a typo.
+                         * Best rejected.
+                         */
+                        '(ab)cd@couc.ou',
+
+                        /*
+                         * The next address is not globally deliverable,
+                         * so it may work with PHPMailer and break with
+                         * mail sending services. Best not allow users
+                         * to paint themselves into that corner. This also
+                         * avoids security problems like those that were
+                         * used to probe the WordPress server's local
+                         * network.
+                        */
+                        'toto@to',
+
+                        /*
+                         * Several addresses are best rejected because
+                         * we don't want to allow sending to fe80::, 192.168
+                         * and other special addresses; that too might
+                         * be used to probe the WordPress server's local
+                         * network.
+                         */
+                        'to@[2001:db8::1]',
+                        'to@[IPv6:2001:db8::1]',
+                        'to@[192.168.1.1]',
+
+                        /*
+                         * Ill-formed UTF-8 byte sequences must be rejected.
+                         * A lone continuation byte (0x80) is not valid UTF-8
+                         * whether it appears in the local part or the domain.
+                         */
+                        "a\x80b@example.com",  // invalid UTF-8 in local part.
+                        "abc@\x80.org",        // invalid UTF-8 in domain subdomain.
                 );