typos icon indicating copy to clipboard operation
typos copied to clipboard

Typo detection skipped due to overzealous email tokenization

Open RudolfMan opened this issue 8 months ago • 4 comments

Description

Variable name prefixed with @ is mistreated as an email address.

id=@nam  # doesn't catch
id= @nam # catches: `nam` should be `name`
id =@nam # catches: `nam` should be `name`

I figured that = is a valid character for local-part of the email address.

So it's tricky to catch that.

However, in our case we also wrap the variable within {} Here is a more realistic example:

  nam = "Rudolf"              # catches: `nam` should be `name`

  def render(assigns) do
    ~H"""
    <span data-foo={@nam}>    # DOESN'T CATCH
      @nam                    # catches: `nam` should be `name`
    </span>
    """
  end

And { IS NOT a valid local-part of the email. So I think we should be able to catch those scenarios!

Unfortunately, I don't know Rust, so it'd take me forever to try to fix that and open a PR.

RudolfMan avatar Apr 23 '25 18:04 RudolfMan

Actually, I'm not sure if it's email tokenization.

id=@nam     # doesn't catch
if=@nam     # doesn't catch
iff=@nam    # catches: `nam` should be `name`
foo=@nam    # catches: `nam` should be `name`
fooo=@nam   # doesn't catch

RudolfMan avatar Apr 23 '25 18:04 RudolfMan

According to wikipedia, = and { are valid local-parts. Its up to individual servers to reject them.

The question is whether we should detect what is strictly allowed or only what is likely.

epage avatar Apr 23 '25 18:04 epage

iff=@nam # catches: nam should be name

Something fishy is going on

epage avatar Apr 23 '25 18:04 epage

iff=@nam # catches: nam should be name

iff= is apparently a valid bas64 encoding and that gets higher precedence than emails.

epage avatar Apr 23 '25 18:04 epage