Bug #92531

Email with php method as string is a valid address

Added by Thomas Löffler 13 days ago. Updated 3 days ago.

Status:
Resolved
Priority:
Should have
Assignee:
Category:
-
Target version:
-
Start date:
2020-10-06
Due date:
% Done:

100%

TYPO3 Version:
10
PHP Version:
7.4
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

  1. How to reproduce

1. Setup a TYPO3 form with an email field
1. Add email validation
1. Go to the form
1. Enter "${@print(md5(security_test))}" as email address
1. Send the form
1. Form was sent successfully

As it's not a valid email address the email sender (website admin) gets a bounce mail.
This can be done very often to flood the email box.

  1. How to solve

Add the DNSCheckValidation to the EmailValidator of library (egulias/EmailValidator).

Associated revisions

Revision 7e95ee3a (diff)
Added by Georg Ringer 3 days ago

[FEATURE] Improved Email Validation

The method :php`\TYPO3\CMS\Core\Utility\GeneralUtility::validEmail`
is used to validate a given email address through the core
and TYPO3 extensions.

The validation can now be configured by providing the used
validators to be used in the LocalConfiguration.php or
AdditionalConfiguration.php.

Example:

$GLOBALS['TYPO3_CONF_VARS']['MAIL']['validators'] = [
\Egulias\EmailValidator\Validation\RFCValidation::class,
\Egulias\EmailValidator\Validation\DNSCheckValidation::class'
];

The RFCValidation validator is still be used as default.

Furthermore, following validators are available:

- Egulias\EmailValidator\Validation\DNSCheckValidation
- Egulias\EmailValidator\Validation\SpoofCheckValidation
- Egulias\EmailValidator\Validation\NoRFCWarningsValidation

It is also possible to provide own validators which must implement
the Egulias\EmailValidator\Validation\EmailValidation interface.

If multiple validators are provided, each validator must return TRUE.

Resolves: #92531
Releases: master
Change-Id: I9c5a0573c2f9bff56bf869dc221a2c0ffd75417b
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66179
Tested-by: Oliver Bartsch <>
Tested-by: TYPO3com <>
Tested-by: Daniel Goerz <>
Reviewed-by: Oliver Bartsch <>
Reviewed-by: Josef Glatz <>
Reviewed-by: Daniel Goerz <>

History

#1 Updated by Georg Ringer 4 days ago

  • Status changed from New to Accepted
  • Assignee set to Georg Ringer

#2 Updated by Georg Ringer 4 days ago

  • Status changed from Accepted to In Progress

#3 Updated by Gerrit Code Review 4 days ago

  • Status changed from In Progress to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66179

#4 Updated by Gerrit Code Review 3 days ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/66179

#5 Updated by Georg Ringer 3 days ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

Also available in: Atom PDF