mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-09-30 19:22:08 +00:00
1bc42842ba
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9074 When registering with an email account including a comment (e.g. `me@example.com (a comment here)`), the comment is removed from the email address. It was possible to include an email address in the comment to bypass the block list. For instance if registering with `me@evilcorp.com (me@example.com)` the mail would incorrectly be verified against the block list using the comment instead of `@evilcorp.com`. This is a regression introduced in Forgejo v12. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Security bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/9074): <!--number 9074 --><!--line 0 --><!--description ZW1haWwgY29tbWVudHMgYXJlIHJlbW92ZWQgZnJvbSBlbWFpbCBhZGRyZXNzZXM=-->email comments are removed from email addresses<!--description--> <!--end release-notes-assistant--> Co-authored-by: famfo <famfo@famfo.xyz> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9083 Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org> Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
66 lines
1.6 KiB
Go
66 lines
1.6 KiB
Go
// Copyright 2025 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"forgejo.org/modules/setting"
|
|
"forgejo.org/modules/test"
|
|
"forgejo.org/modules/validation"
|
|
"forgejo.org/tests"
|
|
|
|
"github.com/gobwas/glob"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestEmailBlocklist(t *testing.T) {
|
|
defer test.MockVariableValue(
|
|
&setting.Service.EmailDomainBlockList,
|
|
[]glob.Glob{glob.MustCompile("evil")},
|
|
)()
|
|
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
emailValid, ok := validation.IsEmailDomainAllowed("🐸@pond")
|
|
assert.True(t, emailValid)
|
|
assert.True(t, ok)
|
|
|
|
emailValid, ok = validation.IsEmailDomainAllowed("🐸@pond (what-is-this@evil)")
|
|
assert.True(t, emailValid)
|
|
assert.True(t, ok)
|
|
|
|
emailValid, ok = validation.IsEmailDomainAllowed("jomo@evil")
|
|
assert.True(t, emailValid)
|
|
assert.False(t, ok)
|
|
|
|
emailValid, ok = validation.IsEmailDomainAllowed("jomo@evil (but-does-it@break)")
|
|
assert.True(t, emailValid)
|
|
assert.False(t, ok)
|
|
}
|
|
|
|
func TestEmailAllowlist(t *testing.T) {
|
|
defer test.MockVariableValue(
|
|
&setting.Service.EmailDomainAllowList,
|
|
[]glob.Glob{glob.MustCompile("pond")},
|
|
)()
|
|
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
emailValid, ok := validation.IsEmailDomainAllowed("🐸@pond")
|
|
assert.True(t, emailValid)
|
|
assert.True(t, ok)
|
|
|
|
emailValid, ok = validation.IsEmailDomainAllowed("🐸@pond (what-is-this@evil)")
|
|
assert.True(t, emailValid)
|
|
assert.True(t, ok)
|
|
|
|
emailValid, ok = validation.IsEmailDomainAllowed("jomo@evil")
|
|
assert.True(t, emailValid)
|
|
assert.False(t, ok)
|
|
|
|
emailValid, ok = validation.IsEmailDomainAllowed("jomo@evil (but-does-it@break)")
|
|
assert.True(t, emailValid)
|
|
assert.False(t, ok)
|
|
}
|