Fix #85

Author: righettod

src/main/java/eu/righettod/SecurityUtils.java

@@ -1052,6 +1052,10 @@ public static byte[] sanitizeFile(String inputFilePath, InputFileType inputFileT
      * <li>Is not using address literals.</li>
      * <li>Is not using source routes.</li>
      * <li>Is not using the "percent hack".</li>
+     * <li>Does not contain newline or carriage-return characters (CRLF injection prevention).</li>
+     * <li>The domain part contains at least one dot (reject single-label domains such as localhost or internal hostnames).</li>
+     * <li>The local part is not a quoted string (i.e. not wrapped in double quotes).</li>
+     * <li>Respect the RFC 5321 length limits: local part ≤ 64 characters, domain ≤ 255 characters, total address ≤ 320 characters.</li>
      * </ul><br>
      * This is based on the research work from <a href="https://portswigger.net/research/gareth-heyes">Gareth Heyes</a> added in references (Portswigger).<br><br>
      *
@@ -1070,7 +1074,7 @@ public static boolean isEmailAddress(String addr) {
         boolean isValid = false;
         String work = addr.toLowerCase(Locale.ROOT);
         Pattern encodedWordRegex = Pattern.compile("[=?]+", Pattern.CASE_INSENSITIVE);
-        Pattern forbiddenCharacterRegex = Pattern.compile("[():!%\\[\\],;]+", Pattern.CASE_INSENSITIVE);
+        Pattern forbiddenCharacterRegex = Pattern.compile("[():!%\\[\\],;\"\n\r]+", Pattern.CASE_INSENSITIVE);
         try {
             //Start with the use of the dedicated EmailValidator from Apache Commons Validator
             if (EmailValidator.getInstance(true, true).isValid(work)) {
@@ -1085,10 +1089,24 @@ public static boolean isEmailAddress(String addr) {
                         // Source routes,
                         // The percent hack.
                         if (!forbiddenCharacterRegex.matcher(work).find()) {
-                            isValid = true;
+                            //If OK ensure that the domain part contains at least one dot
+                            long arobaseCount = addr.chars().filter(c -> c == '@').count();
+                            if (arobaseCount == 1) {
+                                String[] parts = addr.split("@");
+                                String localPart = parts[0];
+                                String domainPart = parts[1];
+                                if (domainPart.contains(".")) {
+                                    //If OK the check the respect to the RFC 5321 length limits:
+                                    // local part ≤ 64 characters, domain ≤ 255 characters, total address ≤ 320 characters.
+                                    if (localPart.length() <= 64 && domainPart.length() <= 255 && addr.length() <= 320) {
+                                        isValid = true;
+                                    }
+                                }
+                            }
                         }
                     }
                 }
+
             }
         } catch (Exception e) {
             isValid = false;

src/test/java/eu/righettod/TestSecurityUtils.java

@@ -477,12 +477,42 @@ public void isEmailAddress() {
         final String templateMsgFalseNegative = "Email address '%s' must be detected as invalid!";
         final String templateMsgFalsePositive = "Email address '%s' must be detected as valid!";
         //Test invalid email addresses
-        List<String> invalidEmailAddressesList = Arrays.asList("=?utf-8?q?=41=42=43?=test@test.com", "=?utf-7?q?=41GYAbwBvAGIAYBy-?=@test@com", "=?utf-8?b?Zm9vYmFy?=@test.com", "@mail.mit.edu:peter@hotmail.com", "peter%hotmail.com@mail.mit.edu", "rusx!umoskva!kgbvax!dimitri@gateway.ru", "test@example.com@evil.com", "(foo)user@(bar)example.com", "postmaster@[123.123.123.123]", "postmaster@[IPv6:2001:0db8:85a3:0000:0000:8a2e:0370:7334]", "foo@xn--mnchen-2ya.com");
+        List<String> invalidEmailAddressesList = Arrays.asList(
+                "notanemail",
+                "@domain.com",
+                "user@",
+                "user@@domain.com",
+                "user @domain.com",
+                "=?utf-8?B?dXNlcg==?=@domain.com",
+                "user@=?utf-8?Q?domain?=.com",
+                "user(comment)@domain.com",
+                "user@domain(comment).com",
+                "user@xn--nxasmq6b.com",
+                "user@xn--p1ai.xn--e1afmapc.com",
+                "relay!user@domain.com",
+                "host1!host2!user@domain.com",
+                "user@[192.168.1.1]",
+                "user@[IPv6:2001:db8::1]",
+                "@relay.com:user@domain.com",
+                "@r1.com,@r2.com:user@domain.com",
+                "user%admin@domain.com",
+                "foo%bar%baz@domain.com",
+                "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa@domain.com", "user@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com", "user@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.com",
+                "\"user\"@domain.com",
+                "\"user name\"@domain.com",
+                "\"user@evil.com\"@domain.com",
+                "user@localhost",
+                "user@internalhost",
+                "user@com",
+                "user\r\n@domain.com",
+                "user\n@domain.com",
+                "user@domain\r.com"
+        );
         invalidEmailAddressesList.forEach(addr -> {
             assertFalse(SecurityUtils.isEmailAddress(addr), String.format(templateMsgFalseNegative, addr));
         });
         //Test valid email addresses
-        List<String> validEmailAddressesList = Arrays.asList("test@test.com", "test-test@test.com", "test.test@test.com", "test_test@test.com", "test132@test.com", "test+label@test.com", "\"John..Doe\"@example.com", "\"@\"@example.com");
+        List<String> validEmailAddressesList = Arrays.asList("test@test.com", "test-test@test.com", "test.test@test.com", "test_test@test.com", "test132@test.com", "test+label@test.com");
         validEmailAddressesList.forEach(addr -> {
             assertTrue(SecurityUtils.isEmailAddress(addr), String.format(templateMsgFalsePositive, addr));
         });