From d5ce06e580bdd0fe79fff580524e32c47658f851 Mon Sep 17 00:00:00 2001
From: Scott Bishel <scott.bishel@mattermost.com>
Date: Tue, 15 Oct 2024 12:21:02 -0600
Subject: [PATCH] MM-60722 - don't allow multiple '@' in email (#28481)

* don't allow quoted strings in email

* don't allow multiple '@' in email

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
---
 server/public/model/utils.go      |  6 +++++
 server/public/model/utils_test.go | 44 +++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/server/public/model/utils.go b/server/public/model/utils.go
index 7ae5f5eff8..662c6ada72 100644
--- a/server/public/model/utils.go
+++ b/server/public/model/utils.go
@@ -631,6 +631,12 @@ func IsValidEmail(email string) bool {
 		return false
 	}
 
+	// mail.ParseAddress accepts quoted strings for the address
+	// which can lead to sending to the wrong email address
+	// check for multiple '@' symbols and invalidate
+	if strings.Count(email, "@") > 1 {
+		return false
+	}
 	return true
 }
 
diff --git a/server/public/model/utils_test.go b/server/public/model/utils_test.go
index 1c1b1cd986..9608d4d921 100644
--- a/server/public/model/utils_test.go
+++ b/server/public/model/utils_test.go
@@ -396,6 +396,50 @@ func TestIsValidEmail(t *testing.T) {
 			Input:    "email1@domain.com, email2@domain.com",
 			Expected: false,
 		},
+		{
+			Input:    "\"attacker@attacker.com,admin\"@spaceship.com",
+			Expected: false,
+		},
+		{
+			Input:    "(email)@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "<email>@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "[email]@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "{email}@domain.com",
+			Expected: true,
+		},
+		{
+			Input:    "first\"name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first:name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first;name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first,name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first@name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "john..doe@example.com",
+			Expected: false,
+		},
 	} {
 		t.Run(testCase.Input, func(t *testing.T) {
 			assert.Equal(t, testCase.Expected, IsValidEmail(testCase.Input))