discourse/spec/lib/validators/email_address_validator_spec.rb
Ted Johansson 60a3fe41d2
FIX: Disallow encoded words in e-mail addresses (#33083)
RFC 5322 allows special characters, including ? and =, to be used in e-mail addresses.

RFC 2047 is an extension that adds a feature called "encoded words" which let you embed different encodings in the same header. However, it explicitly says that these aren't allowed in e-mail address headers.

Encoded words have the format:

encoded-word = "=?" charset "?" encoding "?" encoded-text "?="
Where encoding is either Q or B, but could take on other values in the future.

After this change we consider e-mail addresses with an encoded word inside invalid.
2025-06-05 12:58:01 +08:00

23 lines
658 B
Ruby

# frozen_string_literal: true
RSpec.describe EmailAddressValidator do
it "should match valid emails" do
%w[
test@discourse.org
good_user@discourse.org
incoming+%{reply_key}@discourse.org
].each { |email| expect(EmailAddressValidator.valid_value?(email)).to eq(true) }
end
it "should not match invalid emails" do
[
"testdiscourse.org",
"frank@invalid_host.contoso.com",
"frank@invalid_host.com",
"test@discourse.org; a@discourse.org",
"random",
"te=?utf-8?q?st?=@discourse.org",
"",
].each { |email| expect(EmailAddressValidator.valid_value?(email)).to eq(false) }
end
end