fix(api): reject trailing newline in email() validator#39235
Open
lntutor wants to merge 1 commit into
Open
Conversation
libs/helper.email() validated with re.match against a pattern anchored by `$`. In Python `$` matches at the end of the string OR just before a trailing newline, so "user@example.com\n" passed validation. email() backs the EmailStr type used across the auth surface (login, register, forgot-password, activate, workspace member invite), where a CR/LF in an accepted address is a mail header-injection primitive and defeats exact-match uniqueness/normalization. Switch to re.fullmatch, which requires the entire string to match and so rejects a trailing newline. This changes behavior only for the trailing-newline case; all currently-valid addresses still validate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6RtoHuxrDqTUo9Mw9h4Cv
dosubot
Bot
added
the
size:XS
Contributor
Pyrefly Type Coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #39234
Summary
libs/helper.py::email()validated withre.matchagainst a$-anchored pattern. In Python$matches at end-of-string or just before a trailing newline, soemail("user@example.com\n")returned the value as valid instead of raising.email()backs theEmailStrtype used across the auth surface (login, registration, forgot-password, activate, workspace member invite). A CR/LF in an accepted address is a mail header-injection primitive and defeats exact-match uniqueness/normalization ("a@b.com\n" != "a@b.com").Change
re.fullmatchrequires the entire string to match, rejecting a trailing newline. Behavior changes only for the trailing-newline case — every currently-valid address still validates (verified:re.matchandre.fullmatchdiffer only on strings with content after the$match, i.e. a trailing\n).Tests
Adds
TestEmailValidatortotests/unit_tests/libs/test_helper.py(the validator had no unit tests): accepts valid / special-local-part addresses, rejects trailing newline, missing domain, and plain strings. All 22test_helpertests pass;ruff checkandruff format --checkclean.