Security Warning about email_validator HOT 3 CLOSED

The accepted way to prevent XSS attacks in Rails is to properly escape user inputted data when you are outputting them in your templates rather than validating the data when it is being input. Even with very strict email validation you will still be vulnerable to XSS attacks if you don't properly escape user inputted email addresses. Conversely, if you properly escape email addresses then you will be safe from XSS even if you perform no input validation at all.

You can learn more on the Rails Guides: https://guides.rubyonrails.org/security.html#cross-site-scripting-xss. Also, checkout out the mail_to helper if you are looking for an easy and secure way to generate mailto links.

from email_validator.

from the document:

7.3.2.3 Countermeasures
It is very important to filter malicious input, but it is also important to escape the output of the web application.

Especially for XSS, it is important to do whitelist input filtering instead of blacklist. Whitelist filtering states the values allowed as opposed to the values not allowed. Blacklists are never complete.

...

All I'm saying is you should give people a heads up that their only protection is escaping the output.

from email_validator.

I just think it might not occur to some that this validation philosophy gives them less protection than they might expect.

from email_validator.