Email field zero width space

[09F911029D74E35BD84156C5635688C0]

EmailField allows a zero width space character to be included which is invalid. john@acme.com\u200b and even john@\u200bacme.com are allowed.

I think that first of all CharField should be enhanced to strip the character from both ends of the string, and email field should be enhanced to prohibit it anywhere in the string.

Tested on drf 3.16.1.

[itzzdev09]

Worth knowing before you patch anything in DRF: this isn't DRF-specific. Django's own validator accepts it too, so EmailField is inheriting the behaviour rather than introducing it.

>>> from django.core.validators import validate_email
>>> validate_email("john@acme.com\u200b")   # no exception
>>> validate_email("john@\u200bacme.com")   # no exception

>>> serializers.EmailField().run_validation("john@\u200bacme.com")
'john@\u200bacme.com'

Both are accepted on DRF 3.18.0 / Django 5.2.17, matching what you saw on 3.16.1.

So a fix in EmailField alone would leave django.forms.EmailField, models.EmailField, and anything else calling validate_email still accepting it — which is probably an argument for raising it on the Django side rather than here.

On the two halves of your suggestion, they're worth separating:

Stripping in CharField is the riskier one. trim_whitespace currently follows str.strip(), and U+200B is not whitespace to Python:

>>> "john@acme.com\u200b".strip() == "john@acme.com\u200b"
True

So this wouldn't be a tightening of existing behaviour — it'd be a new rule about which invisible characters get silently removed from every CharField, and picking that set (U+200B alone? all of Cf? ZWNJ and ZWJ, which are meaningful in Persian and Indic text?) is a real decision. Silently mutating input is also harder to debug than rejecting it.

Rejecting in EmailField is much narrower and easier to justify, since no valid address contains a zero-width character anywhere.

If you need this enforced now, a validator on the field does it without touching either project:

import re
from rest_framework import serializers

ZERO_WIDTH = re.compile(r"[\u200b\u200c\u200d\ufeff]")

def no_zero_width(value):
    if ZERO_WIDTH.search(value):
        raise serializers.ValidationError("Email contains zero-width characters.")

email = serializers.EmailField(validators=[no_zero_width])