[Bug Report] '+' symbol in email address filtered in webhook event(s)

[AlanGuerin]

Hi everyone,

I'm new to the Shopify community, but really enjoying playing with the platform so far. 🙂

I'm creating a Shopify App to create a custom fulfilment service, and I've been doing some testing on it. I noticed in the fulfillments/create event (possibly others), that the + symbol has been replaced with a space character in the email address attribute. e.g. I entered "developer+testuser@example.com" during checkout, and the email attribute in the webhook event payload is:

"email": "developer testuser@example.com",

I accept this is an incredibly minor issue, but + is a valid email address character. It should be correctly filtered, otherwise its use should be restricted during checkout.

(Sorry if this isn't the correct place to report bugs!)

[_JB]

Hey @AlanGuerin,

Thanks for bring this up, I've raised the issue with our developers for further investigation. I'll post back here soon as I have an update for you.

[_JB]

Hey @AlanGuerin,

It seems our developer were unable to replicate the issue, so I'd like to kindly ask for the shop_id of the shop you observed this issue on. As well, please let me know if this is a test shop, and if you're ok with me creating a webhook subscription to test with.

[AlanGuerin]

Hi JB,

I sent you a private message with the store URL.

It's a development store, and you can create webhook subscriptions to test this.

I discovered the issue on the fulfillments/create topic.

Kind regards,
Alan

[AlanGuerin]

@_JB 

I've just re-tested this and reconfirmed it's an issue.

In addition, ISO 8601 timestamp offsets are also affected.

(Expecting: "2020-05-26T12:35:30+01:00")

"created_at": "2020-05-26T12:35:30 01:00",

"updated_at": "2020-05-26T12:35:30 01:00",

(Expecting: "developer+test@example.com")

"email": "developer test@example.com",

[AlanGuerin · Accepted solution]

Thank you @_JB for your help with this.

This is not an issue with Shopify, but instead with the webhook consumer. I was consuming webhook messages and resending them downstream using a  application/x-www-form-urlencoded HTTP content type. I neglected to URL encode the message body before sending it, which is why the + symbols were being replaced [quite rightly] with whitespace.

Thank you again for helping me identify this issue!