github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-18 22:22:24 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Reject newlines in email addresses #6161

New Issue
Closed
opened 2025-11-02 06:46:45 -06:00 by GiteaMirror · 7 comments
GiteaMirror commented 2025-11-02 06:46:45 -06:00
Owner
Copy Link

Originally created by @NotAFile on GitHub (Oct 16, 2020).

  • Gitea version (or commit ref): 1.12.5
  • Git version: n/a
  • Operating system: Linux
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist: n/a

Description

When clearing out some spam accounts, I noticed that many of them had email addresses that ended with an "\r\n" character sequence, seemingly as one of several strategies of circumventing email address reuse detection.

Gitea should probably not accept email addresses with newlines in them as valid.

Originally created by @NotAFile on GitHub (Oct 16, 2020). <!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue --> <!-- 1. Please speak English, this is the language all maintainers can speak and write. 2. Please ask questions or configuration/deploy problems on our Discord server (https://discord.gg/gitea) or forum (https://discourse.gitea.io). 3. Please take a moment to check that your issue doesn't already exist. 4. Please give all relevant information below for bug reports, because incomplete details will be handled as an invalid report. --> - Gitea version (or commit ref): 1.12.5 - Git version: n/a - Operating system: Linux - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: n/a ## Description When clearing out some spam accounts, I noticed that many of them had email addresses that ended with an "\r\n" character sequence, seemingly as one of several strategies of circumventing email address reuse detection. Gitea should probably not accept email addresses with newlines in them as valid.
GiteaMirror commented 2025-11-02 06:46:46 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Oct 16, 2020):

I would say: white & blacklist func for email addresses?

@6543 commented on GitHub (Oct 16, 2020): I would say: white & blacklist func for email addresses?
GiteaMirror commented 2025-11-02 06:46:46 -06:00
Author
Owner
Copy Link

@techknowlogick commented on GitHub (Oct 17, 2020):

@6543 we currently have that for emails, but the email validity should just know that those characters are invalid

@techknowlogick commented on GitHub (Oct 17, 2020): @6543 we currently have that for emails, but the email validity should just know that those characters are invalid
GiteaMirror commented 2025-11-02 06:46:47 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Oct 17, 2020):

OK if we want to get in to this we will need to read:

https://en.wikipedia.org/wiki/Email_address

https://tools.ietf.org/html/rfc3696

https://tools.ietf.org/html/rfc5321

https://tools.ietf.org/html/rfc5322

@zeripath commented on GitHub (Oct 17, 2020): OK if we want to get in to this we will need to read: https://en.wikipedia.org/wiki/Email_address https://tools.ietf.org/html/rfc3696 https://tools.ietf.org/html/rfc5321 https://tools.ietf.org/html/rfc5322
GiteaMirror commented 2025-11-02 06:46:47 -06:00
Author
Owner
Copy Link

@NotAFile commented on GitHub (Oct 17, 2020):

I should note that the format was localpart@domain\r\n, which does not make sense and is definitely not valid. The localpart of email addresses is very liberal, but the latter part is much more strict and newlines are not valid in DNS.

@NotAFile commented on GitHub (Oct 17, 2020): I should note that the format was `localpart@domain\r\n`, which does not make sense and is definitely not valid. The localpart of email addresses is very liberal, but the latter part is much more strict and newlines are not valid in DNS.
GiteaMirror commented 2025-11-02 06:46:47 -06:00
Author
Owner
Copy Link

@chrisshyi commented on GitHub (Oct 30, 2020):

I can work on this if nobody's been assigned yet!

@chrisshyi commented on GitHub (Oct 30, 2020): I can work on this if nobody's been assigned yet!
GiteaMirror commented 2025-11-02 06:46:47 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Oct 30, 2020):

@chrisshyi go on for it 👍

If you have questions just ask us on discord ...

@6543 commented on GitHub (Oct 30, 2020): @chrisshyi go on for it 👍 If you have questions just ask us on discord ...
GiteaMirror commented 2025-11-02 06:46:48 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Apr 3, 2021):

email is now Validated via models.ValidateEmail() witch use mail.ParseAddress()

-> https://golang.org/pkg/net/mail/#ParseAddress

@6543 commented on GitHub (Apr 3, 2021): email is now Validated via `models.ValidateEmail()` witch use `mail.ParseAddress()` -> https://golang.org/pkg/net/mail/#ParseAddress
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#6161
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?