Email validation accepts a trailing newline

Open Beginner friendly
  • Is something wrong?
#5,592 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@marcello-pichini is already working on this.

Since Nov 14, 2026.

  • #5593 by @marcello-pichini — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
backend

Research direction

Start with EMAIL_PATTERN and validate_email in backend/utils/validation, since its trailing $ lets a final LF match. Then check how UserForm in backend/endpoints/forms/identity preserves the value. Run the reproduction script from the issue to confirm LF and CRLF behave differently. Done when both trailing-newline variants are rejected consistently and the existing validation tests still pass.

Written by the indexing model from the issue text.

Description

RomM version

master at eb10d95813a832ece0219b495a30400ad5a993c1.

Describe the bug

validate_email accepts an otherwise valid address ending in a single LF character, for example "[email protected]\n". UserForm preserves that character. The user endpoints validate this value and then lowercase it without removing the newline.

To Reproduce

With the backend dependencies installed and Python 3.14, run from the repository root:

PYTHONPATH=backend python - <<'PY'
from endpoints.forms.identity import UserForm
from utils.validation import ValidationError, validate_email

for address in ("[email protected]", "[email protected]\n", "[email protected]\r\n"):
    email = UserForm.model_validate({"email": address}).email
    try:
        validate_email(email)
    except ValidationError:
        print(repr(email), "rejected")
    else:
        print(repr(email), "accepted")
PY

Observed: the ordinary address and LF-terminated address are accepted; the CRLF-terminated address is rejected.

Expected behavior

An address containing a trailing newline is rejected consistently.

Server

Reproduced on macOS with Python 3.14.9. A regression test also confirms that updating a user email through PUT /api/users/{id} accepts the LF-terminated value before the fix.

Additional context

EMAIL_PATTERN ends with $, which Python can match immediately before a final newline. The existing ASCII-only check permits LF. The confirmed problem is inconsistent email validation; no downstream mail-header or authentication impact is claimed.

Dominant language
Python
Stars
13.3k
Forks
747
Avg merge
1d 3h
Merged PRs (30d)
183

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rommapp/romm

All issues in rommapp/romm

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.