diff options
| author | Dejan Kitic <137049545+dek5troza@users.noreply.github.com> | 2025-04-20 12:18:14 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-04-20 19:18:14 +0800 |
| commit | af6be75adb99ff42215a945927c016aa5e40dab2 (patch) | |
| tree | 3754caf187e19e59789b14daf95953ac47903feb /modules/markup/html.go | |
| parent | 6d3c6741ec4ecdc59e2b57c8a9cfb2e019a7a9e7 (diff) | |
| download | gitea-af6be75adb99ff42215a945927c016aa5e40dab2.tar.gz gitea-af6be75adb99ff42215a945927c016aa5e40dab2.zip | |
Valid email address should only start with alphanumeric (#28174)
This fixes issue #27847 where regular expression allowed email address
to start with special symbols. Valid email addresses should start with
alphanumeric character, and as such will be rendered as email.
Added test cases from the bug report to validate, such input will not be
rendered anymore as email address.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Diffstat (limited to 'modules/markup/html.go')
| -rw-r--r-- | modules/markup/html.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/modules/markup/html.go b/modules/markup/html.go index 0e074cbcfa..7c3bd93699 100644 --- a/modules/markup/html.go +++ b/modules/markup/html.go @@ -71,7 +71,8 @@ var globalVars = sync.OnceValue(func() *globalVarsType { // it is still accepted by the CommonMark specification, as well as the HTML5 spec: // http://spec.commonmark.org/0.28/#email-address // https://html.spec.whatwg.org/multipage/input.html#e-mail-state-(type%3Demail) - v.emailRegex = regexp.MustCompile("(?:\\s|^|\\(|\\[)([a-zA-Z0-9.!#$%&'*+\\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9]{2,}(?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+)(?:\\s|$|\\)|\\]|;|,|\\?|!|\\.(\\s|$))") + // At the moment, we use stricter rule for rendering purpose: only allow the "name" part starting after the word boundary + v.emailRegex = regexp.MustCompile(`\b([-\w.!#$%&'*+/=?^{|}~]*@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9]{2,}(?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+)\b`) // emojiShortCodeRegex find emoji by alias like :smile: v.emojiShortCodeRegex = regexp.MustCompile(`:[-+\w]+:`) |