nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-05-20 11:04:31 -05:00
Code

Fixes for StrictEmailAddressAttribute (#1474)

Browse Source 
* Use StrictEmail validation for changing email

* Add trailing symbols to illegal chars in emails

* Add semicolon as always illegal

* Replace regex with MimeKit parsing, add unit test

* Add more unit tests

* Fix linting
This commit is contained in:
Thomas Rittson 2021-07-23 05:59:10 +10:00 committed by GitHub
parent 7a135ae7cd
commit 757102fd96
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 65 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Core/Models/Api/Request/Accounts/EmailTokenRequestModel.cs
View File

@ -1,11 +1,12 @@
using System.ComponentModel.DataAnnotations;
using Bit.Core.Utilities;
namespace Bit.Core.Models.Api
{
public class EmailTokenRequestModel
{
[Required]
[EmailAddress]
[StrictEmailAddress]
[StringLength(256)]
public string NewEmail { get; set; }
[Required]

18
src/Core/Utilities/StrictEmailAddressAttribute.cs
View File

@ -1,6 +1,5 @@
using System;
using System.ComponentModel.DataAnnotations;
using System.Text.RegularExpressions;
using System.ComponentModel.DataAnnotations;
using MimeKit;
namespace Bit.Core.Utilities
{
@ -18,12 +17,19 @@ namespace Bit.Core.Utilities
return false;
}
var illegalChars = @"[\s<>()]";
if (Regex.IsMatch(emailAddress, illegalChars))
try
{
var parsedEmailAddress = MailboxAddress.Parse(emailAddress).Address;
if (parsedEmailAddress != emailAddress)
{
return false;
}
}
catch (ParseException e)
{
return false;
}
return new EmailAddressAttribute().IsValid(emailAddress);
}
}

51
test/Core.Test/Utilities/StrictEmailAddressAttributeTests.cs Normal file
View File

@ -0,0 +1,51 @@
using Bit.Core.Utilities;
using Xunit;
namespace Bit.Core.Test.Utilities
{
public class StrictEmailAttributeTests
{
[Theory]
[InlineData("hello@world.com")] // regular email address
[InlineData("hello@world.planet.com")] // subdomain
[InlineData("hello+1@world.com")] // alias
[InlineData("hello.there@world.com")] // period in local-part
public void IsValid_ReturnsTrueWhenValid(string email)
{
var sut = new StrictEmailAddressAttribute();
var actual = sut.IsValid(email);
Assert.True(actual);
}
[Theory]
[InlineData(null)] // null
[InlineData("hello@world.com\t")] // trailing tab char
[InlineData("\thello@world.com")] // leading tab char
[InlineData("hel\tlo@world.com")] // local-part tab char
[InlineData("hello@world.com\b")] // trailing backspace char
[InlineData("\" \"hello@world.com")] // leading spaces in quotes
[InlineData("hello@world.com\" \"")] // trailing spaces in quotes
[InlineData("hel\" \"lo@world.com")] // local-part spaces in quotes
[InlineData("hello there@world.com")] // unescaped unquoted spaces
[InlineData("Hello <hello@world.com>")] // friendly from
[InlineData("<hello@world.com>")] // wrapped angle brackets
[InlineData("hello(com)there@world.com")] // comment
[InlineData("hello@world.com.")] // trailing period
[InlineData(".hello@world.com")] // leading period
[InlineData("hello@world.com;")] // trailing semicolon
[InlineData(";hello@world.com")] // leading semicolon
[InlineData("hello@world.com; hello@world.com")] // semicolon separated list
[InlineData("hello@world.com, hello@world.com")] // comma separated list
public void IsValid_ReturnsFalseWhenInvalid(string email)
{
var sut = new StrictEmailAddressAttribute();
var actual = sut.IsValid(email);
Assert.False(actual);
}
}
}