WPIntell

Source evidence

Substring domain matching

Antideo Email Validator · support · 2022-04-27T21:59:00+00:00

complaintsentiment
mediumseverity
0.69relevance
0replies
Evidence onlycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

1 / 1 rows with source links

100.0% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

0 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
xenonofarcticus unresolved
I noticed the existing code in antideo-email-validator.php line 708 (domain blacklisting) does: $black_listed = false; foreach($domain_blacklist as $key => $value){ if (stripos($value, $domain) !== false) { $black_listed = true; } } This potentially could match a blacklist entry of foo.co if the email address was foo.co.uk because foo.co ($value) will be found within foo.co.uk ($domain). These should not match, however as they are different domains. Additionally, trying to blacklist a subdomain like foo.bar.com will accidentally catch ANY bar.com emails, because bar.com ($domain, the ‘needle’ in the search) does appear in foo.bar.com ($value, the ‘haystack’). The solution would seem to be to do str_ends_with() instead of stripos(), to make sure that the blacklisted domain is found AT THE END of the string being tested, not anywhere within it. This would also allow for blacklisting of entire top level domains (like .xxx or .adult) to catch all domains within the TLD. A potential implementation would look like $black_listed = false; foreach($domain_blacklist as $key => $value){ if (str_ends_with($domain, $value) == true) { $black_listed = true; } }

Comments

0 shown

No comments were stored for this source.