Update regexp pattern to safer one

server/src/main/java/com/vaadin/data/validator/EmailValidator.java

@@ -34,6 +34,12 @@
 @SuppressWarnings("serial")
 public class EmailValidator extends RegexpValidator {
 
+    private static final String PATTERN = "^" + "([a-zA-Z0-9_\\.\\-+])+" // local
+            + "@" + "[a-zA-Z0-9-.]+" // domain
+            + "\\." + "[a-zA-Z0-9-]{2,}" // tld
+            + "$";
+
+
     /**
      * Creates a validator for checking that a string is a syntactically valid
      * e-mail address.
@@ -42,7 +48,6 @@ public class EmailValidator extends RegexpValidator {
      *            the message to display in case the value does not validate.
      */
     public EmailValidator(String errorMessage) {
-        super("^([a-zA-Z0-9_\\.\\-+])+@(([a-zA-Z0-9-])+\\.)+([a-zA-Z0-9]{2,4})+$",
-                true, errorMessage);
+        super(PATTERN, true, errorMessage);
     }
 }

server/src/test/java/com/vaadin/tests/data/validator/EmailValidatorTest.java

@@ -28,4 +28,10 @@ public void testEmailValidatorWithFaultyString() {
     public void testEmailValidatorWithOkEmail() {
         Assert.assertTrue(validator.isValid("my.name@email.com"));
     }
+
+    @Test
+    public void testEmailValidatorWithBadInput() {
+        Assert.assertFalse(validator.isValid("a@a.m5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZ&"));
+    }
+
 }