Sanitize mail addresses

src/api/auth.ts

@@ -20,7 +20,7 @@ import { Router } from 'express'
 import { BadRequest } from 'http-errors'
 import { Database } from '../database'
 import { sendLoginCode, signInByMailCode } from '../function/authentication/login-by-mail'
-import { isMailServerBlacklisted } from '../util/mail'
+import { isMailServerBlacklisted, sanitizeMailAddress } from '../util/mail'
 import {
   isSendMailLoginCodeRequest,
   isSignInByMailCodeRequest
@@ -35,11 +35,17 @@ export const createAuthRouter = (database: Database) => {
         throw new BadRequest()
       }
 
-      if (isMailServerBlacklisted(req.body.mail)) {
+      const mail = sanitizeMailAddress(req.body.mail)
+
+      if (!mail) {
+        throw new BadRequest()
+      }
+
+      if (isMailServerBlacklisted(mail)) {
         res.json({ mailServerBlacklisted: true })
       } else {
         const { mailLoginToken } = await sendLoginCode({
-          mail: req.body.mail,
+          mail,
           locale: req.body.locale,
           database
         })

src/util/mail.ts

@@ -15,6 +15,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
+import { parseOneAddress } from 'email-addresses'
 import * as Email from 'email-templates'
 import { join } from 'path'
 
@@ -89,3 +90,19 @@ export function isMailServerBlacklisted (mail: string) {
 
   return mailServerBlacklist.indexOf(domain.toLowerCase()) !== -1
 }
+
+export function sanitizeMailAddress (input: string): string | null {
+  const parsed = parseOneAddress(input)
+
+  if ((!parsed) || (parsed.type !== 'mailbox')) {
+    return null
+  }
+
+  const address = (parsed as any).address
+
+  if (typeof address !== 'string') {
+    throw new Error('illegal state')
+  }
+
+  return address
+}