Description
Symfony version(s) affected
6.1.4, but actually every version since html5 mode introduction
Description
There is a small mismatch between the html5 regex in symfony/validator and the example regex listed on MDN (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/email#basic_validation) or whatwg (https://html.spec.whatwg.org/dev/input.html#email-state-(type=email)).
It's only the last quantifier. While MDN and whatwg both use an asterisk (*) as last quantifier, the EmailValidator uses a plus (+).
This causes html to allow email addresses without a tld, while the EmailValidator disallows them.
How to reproduce
Just compare the tests of both regexes:
https://3v4l.org/aRdqA#v8.1.10
The mdn regex allowed email addresses without a tld, such as "test@localhost". The one in the EmailValidator disallows them.
Possible Solution
Since email addresses with a tld-less domain are actually valid, I propose to update the regex for the html5 validator.
I have not created a PR yet, but might create one. Reasoning for not creating it yet is, I'm unsure about the target version.
In my opinion this would be a bugfix, but it's also a breaking change, since it would allow email addresses which were disallowed until now.
Also I would propose to allow domains without tld for loose mode, but I'd like to discuss that first.
So my questions are:
Which branch should a PR target?
Is anyone against allowing tld-less domains when using "loose" mode?
Additional Context
No response