Repository: validatorjs/validator.js (js)

Issue:
Non breaking space bypass email validation
"test test@test.com" won't pass since it's a regular space (0x0020), but "test test@test.com" will pass since it's a non breaking space (0x00A0).

In fact, /\s/ regex pattern is not checking for non breaking spaces.

Here is a thread about it: https://stackoverflow.com/questions/31790440/regex-to-replace-no-break-space

Pull request description:
isEmail: do not allow non-breaking space in user part
# bug(isEmail) Do not allow non-breaking space in user part

> Fixes #2218 

- Excluded non-breaking space character from range of acceptable UTF8 characters in the user part of email address

- Added test cases to confirm fix

## Checklist

- [X] PR contains only changes related; no stray files, etc.
- [X] README updated (where applicable)
- [X] Tests written (where applicable)
- [X] References provided in PR (where applicable)


Patch:
diff --git a/src/lib/isEmail.js b/src/lib/isEmail.js
index d1c35bd..34fb239 100644
--- a/src/lib/isEmail.js
+++ b/src/lib/isEmail.js
@@ -22,7 +22,7 @@ const splitNameAddress = /^([^\x00-\x1F\x7F-\x9F\cX]+)</i;
 const emailUserPart = /^[a-z\d!#\$%&'\*\+\-\/=\?\^_`{\|}~]+$/i;
 const gmailUserPart = /^[a-z\d]+$/;
 const quotedEmailUser = /^([\s\x01-\x08\x0b\x0c\x0e-\x1f\x7f\x21\x23-\x5b\x5d-\x7e]|(\\[\x01-\x09\x0b\x0c\x0d-\x7f]))*$/i;
-const emailUserUtf8Part = /^[a-z\d!#\$%&'\*\+\-\/=\?\^_`{\|}~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]+$/i;
+const emailUserUtf8Part = /^[a-z\d!#\$%&'\*\+\-\/=\?\^_`{\|}~\u00A1-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]+$/i;
 const quotedEmailUserUtf8 = /^([\s\x01-\x08\x0b\x0c\x0e-\x1f\x7f\x21\x23-\x5b\x5d-\x7e\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]|(\\[\x01-\x09\x0b\x0c\x0d-\x7f\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]))*$/i;
 const defaultMaxEmailLength = 254;
 /* eslint-enable max-len */


Test patch:
diff --git a/test/validators.test.js b/test/validators.test.js
index d0753de..bb70579 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -66,6 +66,9 @@ describe('Validators', () => {
         '"wrong()[]",:;<>@@gmail.com',
         'username@domain.com�',
         'username@domain.com©',
+        'nbsp test@test.com',
+        'nbsp_test@te st.com',
+        'nbsp_test@test.co m',
       ],
     });
   });
@@ -117,6 +120,7 @@ describe('Validators', () => {
         'hans.m端ller@test.com',
         'z@co.c',
         'tüst@invalid.com',
+        'nbsp test@test.com',
       ],
     });
   });