fix: email comments are removed from email addresses (#9074)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9074
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>

modules/validation/email.go

@@ -72,16 +72,23 @@ func validateEmailBasic(email string) error {
 }
 
 func validateEmailDomain(email string) error {
-	if !IsEmailDomainAllowed(email) {
+	if _, ok := IsEmailDomainAllowed(email); !ok {
 		return ErrEmailInvalid{email}
 	}
 
 	return nil
 }
 
-func IsEmailDomainAllowed(email string) bool {
-	return isEmailDomainAllowedInternal(
-		email,
+func IsEmailDomainAllowed(email string) (validEmail, ok bool) {
+	// Normalized the address. This strips for example comments which could be
+	// used to smuggle a different domain
+	parsedAddress, err := mail.ParseAddress(email)
+	if err != nil {
+		return false, false
+	}
+
+	return true, isEmailDomainAllowedInternal(
+		parsedAddress.Address,
 		setting.Service.EmailDomainAllowList,
 		setting.Service.EmailDomainBlockList)
 }

modules/validation/email_test.go

@@ -67,8 +67,3 @@ func TestEmailAddressValidate(t *testing.T) {
 		})
 	}
 }
-
-func TestEmailDomainAllowList(t *testing.T) {
-	res := IsEmailDomainAllowed("someuser@localhost.localdomain")
-	assert.True(t, res)
-}