Skip to content

UserCreateSchema.email accepts any string — no email format validation #945

Description

@Peopl3s

What's wrong?

The User model uses email = EmailField(unique=True), which implies a valid email address. The Pydantic schema does not enforce this:

class UserCreateSchema(pydantic.BaseModel):
      email: str <!--------------------------------------HERE

Invalid email addresses pass Pydantic validation and either cause a database-level error (PostgreSQL does not validate email format) or get stored as garbage data. There is no user-facing 422 response explaining the format requirement.

How it should be?

Use pydantic.EmailStr to validate email format at the serializer layer:

from pydantic import EmailStr
                                                                                                                                                                                                            class UserCreateSchema(pydantic.BaseModel):
    email: EmailStr                                                                                                                                                                                       
    role: RoleSchema                                  
    tags: list[TagSchema]

Used versions

0.7.0

OS information

MacOS

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions