Commit Graph

3 Commits

Author SHA1 Message Date
60a3fe41d2 FIX: Disallow encoded words in e-mail addresses (#33083)
RFC 5322 allows special characters, including ? and =, to be used in e-mail addresses.

RFC 2047 is an extension that adds a feature called "encoded words" which let you embed different encodings in the same header. However, it explicitly says that these aren't allowed in e-mail address headers.

Encoded words have the format:

encoded-word = "=?" charset "?" encoding "?" encoded-text "?="
Where encoding is either Q or B, but could take on other values in the future.

After this change we consider e-mail addresses with an encoded word inside invalid.
2025-06-05 12:58:01 +08:00
d7164d57ec SECURITY: Block registrations for encoded emails that are invalid 2024-10-07 11:48:52 +08:00
3bf3b9a4a5 DEV: pull email address validation out to a new EmailAddressValidator
We validate the *format* of email addresses in many places with a match against
a regex, often with very slightly different syntax.

Adding a separate EmailAddressValidator simplifies the code in a few spots and
feels cleaner.

Deprecated the old location in case someone is using it in a plugin.

No functionality change is in this commit.

Note: the regex used at the moment does not support using address literals, e.g.:
* localpart@[192.168.0.1]
* localpart@[2001:db8::1]
2022-02-17 21:49:22 -05:00