fix: add stricter rules for the admin email field#441
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds SMTP admin email validation: a new SMTPConfiguration.Validate() parses AdminEmail, rejects addresses whose domain equals or is a subdomain of any configured ReservedDomains, exposes ReservedDomains in SMTPConfiguration, adds a table-driven unit test, documents SMTP_RESERVED_DOMAINS in the README, and invokes Validate() from CreateInstance and UpdateInstance when BaseConfig is provided, returning 400 on validation failure. Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
conf/configuration_test.go (1)
33-39: ⚡ Quick winAdd a regression case for quoted local-parts containing
@.Please add a case like
"\"a@b\"@netlify.com"expecting an error, so this bypass path stays covered long-term.🧪 Suggested test case addition
{ {"", false}, // empty is fine {"noreply@example.com", false}, // valid non-Netlify domain {"team@netlify.com", true}, // reserved domain {"user@netlify.app", true}, // reserved domain {"user@sub.netlify.com", true}, // subdomain of reserved + {"\"a@b\"@netlify.com", true}, // quoted local-part with '@' must still be blocked {"not-an-email", true}, // invalid format }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@conf/configuration_test.go` around lines 33 - 39, Add a regression test entry for quoted local-parts containing @ by inserting the case {"\"a@b\"@netlify.com", true} into the existing test cases array in configuration_test.go (the same table with entries like {"noreply@example.com", false} and {"team@netlify.com", true}) so the validation logic that handles quoted local-parts is exercised and expected to error; ensure the string is properly escaped in the Go source.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/instance.go`:
- Around line 111-115: CreateInstance currently skips SMTP validation allowing
bypass of reserved-domain rules; add the same SMTP config validation used in the
update path by invoking params.BaseConfig.SMTP.Validate() inside CreateInstance
(the same check you see in the UpdateInstance branch) and return
badRequestError("Invalid SMTP configuration: %v", err) on failure so
BaseConfig.SMTP.AdminEmail is enforced at creation time as well.
In `@conf/configuration.go`:
- Around line 297-305: The current validation uses strings.Split(addr.Address,
"@") which fails for quoted local-parts containing '@' (e.g.,
"\"a@b\"@netlify.com") and thus skips reserved-domain checks; change the logic
in the block that reads addr.Address to find the last '@' using
strings.LastIndex, if idx >= 0 extract domain :=
strings.ToLower(addr.Address[idx+1:]), then iterate over reservedDomains and use
domain == reserved or strings.HasSuffix(domain, "."+reserved) to return the same
error; also handle the case idx < 0 by skipping validation (or treating as
invalid per existing behavior) so behavior is correct for RFC5322 addresses.
---
Nitpick comments:
In `@conf/configuration_test.go`:
- Around line 33-39: Add a regression test entry for quoted local-parts
containing @ by inserting the case {"\"a@b\"@netlify.com", true} into the
existing test cases array in configuration_test.go (the same table with entries
like {"noreply@example.com", false} and {"team@netlify.com", true}) so the
validation logic that handles quoted local-parts is exercised and expected to
error; ensure the string is properly escaped in the Go source.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bfcb455c-1810-4382-8b44-d74e3e002906
📒 Files selected for processing (3)
api/instance.goconf/configuration.goconf/configuration_test.go
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@conf/configuration.go`:
- Around line 298-301: The comparison against s.ReservedDomains is using a
normalized domain variable but comparing it to raw reserved entries, allowing
bypasses; update the check in the loop that iterates s.ReservedDomains (the
block that computes domain from addr.Address) to normalize each reserved entry
before comparing - e.g., apply strings.TrimSpace, strings.ToLower and remove any
trailing dot characters from the reserved string, then compare
normalizedReserved == domain or strings.HasSuffix(domain,
"."+normalizedReserved) so entries like " Netlify.COM." match correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c22db56b-019b-4f81-aa11-7b8f3195b144
📒 Files selected for processing (3)
README.mdconf/configuration.goconf/configuration_test.go
khendrikse
force-pushed
the
SEC-860/stricter-from-email-rules
branch
from
9b1decd to
7b85b84
Compare
khendrikse
force-pushed
the
SEC-860/stricter-from-email-rules
branch
from
7b85b84 to
2ef740a
Compare
2 participants
- Summary
Adds validation to
SMTPConfigurationthat rejectsadmin_emailvalues that the gotrue entity does not allow. Closing a vulnerability where an attacker could send SPF/DKIM/DMARC-authenticated phishing emails fromteam@example.comvia the default mail infrastructure. Validation runs at update time inUpdateInstanceand covers exact domain matches, subdomains, and invalid email formats.- Test plan
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)