oss/forgejo
oss/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-10-10 19:32:02 +00:00
Code Wiki Activity

[v12.0/forgejo] fix: email comments are removed from email addresses (#9083)

Browse source 
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9074

When registering with an email account including a comment (e.g. `me@example.com (a comment here)`), the comment is removed from the email address. It was possible to include an email address in the comment to bypass the block list. For instance if registering with `me@evilcorp.com (me@example.com)` the mail would incorrectly be verified against the block list using the comment instead of `@evilcorp.com`. This is a regression introduced in Forgejo v12.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9074): <!--number 9074 --><!--line 0 --><!--description ZW1haWwgY29tbWVudHMgYXJlIHJlbW92ZWQgZnJvbSBlbWFpbCBhZGRyZXNzZXM=-->email comments are removed from email addresses<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: famfo <famfo@famfo.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9083
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
This commit is contained in:
forgejo-backport-action 2025-08-30 18:45:30 +02:00 • committed by Earl Warren
parent 192018324f
commit 1bc42842ba
9 changed files with 99 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

14
services/forms/user_form_test.go
View file

@ -20,7 +20,9 @@ func TestRegisterForm_IsDomainAllowed_Empty(t *testing.T) {
form := RegisterForm{}
assert.True(t, form.IsEmailDomainAllowed())
emailValid, ok := form.IsEmailDomainAllowed()
assert.False(t, emailValid)
assert.False(t, ok)
}
func TestRegisterForm_IsDomainAllowed_InvalidEmail(t *testing.T) {
@ -36,7 +38,8 @@ func TestRegisterForm_IsDomainAllowed_InvalidEmail(t *testing.T) {
for _, v := range tt {
form := RegisterForm{Email: v.email}
assert.False(t, form.IsEmailDomainAllowed())
_, ok := form.IsEmailDomainAllowed()
assert.False(t, ok)
}
}
@ -59,7 +62,8 @@ func TestRegisterForm_IsDomainAllowed_AllowedEmail(t *testing.T) {
for _, v := range tt {
form := RegisterForm{Email: v.email}
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
_, ok := form.IsEmailDomainAllowed()
assert.Equal(t, v.valid, ok)
}
}
@ -72,7 +76,6 @@ func TestRegisterForm_IsDomainAllowed_BlockedEmail(t *testing.T) {
}{
{"security@gitea.io", false},
{"security@gitea.example", true},
{"invalid", true},
{"user@my.block", false},
{"user@my.block1", true},
@ -81,7 +84,8 @@ func TestRegisterForm_IsDomainAllowed_BlockedEmail(t *testing.T) {
for _, v := range tt {
form := RegisterForm{Email: v.email}
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
_, ok := form.IsEmailDomainAllowed()
assert.Equal(t, v.valid, ok)
}
}