oss/forgejo
oss/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-09-30 19:22:08 +00:00
Code Wiki Activity

[v12.0/forgejo] fix: email comments are removed from email addresses (#9083)

Browse source 
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9074

When registering with an email account including a comment (e.g. `me@example.com (a comment here)`), the comment is removed from the email address. It was possible to include an email address in the comment to bypass the block list. For instance if registering with `me@evilcorp.com (me@example.com)` the mail would incorrectly be verified against the block list using the comment instead of `@evilcorp.com`. This is a regression introduced in Forgejo v12.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9074): <!--number 9074 --><!--line 0 --><!--description ZW1haWwgY29tbWVudHMgYXJlIHJlbW92ZWQgZnJvbSBlbWFpbCBhZGRyZXNzZXM=-->email comments are removed from email addresses<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: famfo <famfo@famfo.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9083
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
This commit is contained in:
forgejo-backport-action 2025-08-30 18:45:30 +02:00 • committed by Earl Warren
parent 192018324f
commit 1bc42842ba
9 changed files with 99 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

15
modules/validation/email.go
View file

@ -72,16 +72,23 @@ func validateEmailBasic(email string) error {
}
func validateEmailDomain(email string) error {
if !IsEmailDomainAllowed(email) {
if _, ok := IsEmailDomainAllowed(email); !ok {
return ErrEmailInvalid{email}
}
return nil
}
func IsEmailDomainAllowed(email string) bool {
return isEmailDomainAllowedInternal(
email,
func IsEmailDomainAllowed(email string) (validEmail, ok bool) {
// Normalized the address. This strips for example comments which could be
// used to smuggle a different domain
parsedAddress, err := mail.ParseAddress(email)
if err != nil {
return false, false
}
return true, isEmailDomainAllowedInternal(
parsedAddress.Address,
setting.Service.EmailDomainAllowList,
setting.Service.EmailDomainBlockList)
}