Hacker News new | ask | show | jobs
by kelnos 2339 days ago
Ouch. The root of the issue is that they do a validity check for the local and domain part of the recipient email address. If either one (or both) is invalid, they then check to see if the domain part is empty. If it is, they replace the empty domain with the default domain, and then say it's all valid, ignoring the fact that the local part might also be invalid.
1 comments

The root of the issue is relying on ad-hoc string escaping for security.