Merge pull request #9978 from mfo/US/enforce-real-email-validation

feat(email): stricter validation

app/components/simple_format_component.rb

@@ -22,7 +22,7 @@ class SimpleFormatComponent < ApplicationComponent
   }
 
   SIMPLE_URL_REGEX = %r{https?://[^\s<>]+}
-  EMAIL_IN_TEXT_REGEX = Regexp.new(Devise.email_regexp.source.gsub(/\\A|\\z/, '\b'))
+  EMAIL_IN_TEXT_REGEX = Regexp.new(StrictEmailValidator::REGEXP.source.gsub(/\\A|\\z/, '\b'))
 
   def initialize(text, allow_a: true, allow_autolink: true, class_names_map: {})
     @allow_a = allow_a

app/controllers/users/sessions_controller.rb

@@ -29,7 +29,7 @@ class Users::SessionsController < Devise::SessionsController
   end
 
   def link_sent
-    if Devise.email_regexp.match?(params[:email])
+    if StrictEmailValidator::REGEXP.match?(params[:email])
       @email = params[:email]
     else
       redirect_to root_path

app/models/avis.rb

@@ -21,7 +21,7 @@ class Avis < ApplicationRecord
     content_type: AUTHORIZED_CONTENT_TYPES,
     size: { less_than: FILE_MAX_SIZE }
 
-  validates :email, format: { with: Devise.email_regexp, message: "n'est pas valide" }, allow_nil: true
+  validates :email, strict_email: true, allow_nil: true
   validates :question_answer, inclusion: { in: [true, false] }, on: :update, if: -> { question_label.present? }
   validates :piece_justificative_file, size: { less_than: FILE_MAX_SIZE }
   validates :introduction_file, size: { less_than: FILE_MAX_SIZE }

app/models/champs/email_champ.rb

@@ -1,2 +1,5 @@
 class Champs::EmailChamp < Champs::TextChamp
+  include EmailSanitizableConcern
+  before_validation -> { sanitize_email(:value) }
+  validates :value, format: { with: StrictEmailValidator::REGEXP }, if: :validate_champ_value?
 end

app/models/concerns/user_find_by_concern.rb

@@ -11,7 +11,7 @@ module UserFindByConcern
     end
 
     def self.find_all_by_identifier_with_emails(ids: [], emails: [])
-      valid_emails, invalid_emails = emails.partition { Devise.email_regexp.match?(_1) }
+      valid_emails, invalid_emails = emails.partition { StrictEmailValidator::REGEXP.match?(_1) }
 
       [
         where(id: ids).or(where(users: { email: valid_emails })).distinct(:id),

app/models/contact_information.rb

@@ -1,13 +1,16 @@
 class ContactInformation < ApplicationRecord
+  include EmailSanitizableConcern
+
   belongs_to :groupe_instructeur
 
   validates :nom, presence: { message: 'doit être renseigné' }, allow_nil: false
   validates :nom, uniqueness: { scope: :groupe_instructeur, message: 'existe déjà' }
-  validates :email, format: { with: Devise.email_regexp, message: "n'est pas valide" }, presence: { message: 'doit être renseigné' }, allow_nil: false
+  validates :email, strict_email: true, presence: { message: 'doit être renseigné' }, allow_nil: false
   validates :telephone, phone: { possible: true, allow_blank: false }
   validates :horaires, presence: { message: 'doivent être renseignés' }, allow_nil: false
   validates :adresse, presence: { message: 'doit être renseignée' }, allow_nil: false
   validates :groupe_instructeur, presence: { message: 'doit être renseigné' }, allow_nil: false
+  before_validation -> { sanitize_email(:email) }
 
   def pretty_nom
     nom

app/models/dossier_transfer.rb

@@ -4,7 +4,7 @@ class DossierTransfer < ApplicationRecord
 
   EXPIRATION_LIMIT = 2.weeks
 
-  validates :email, format: { with: Devise.email_regexp }
+  validates :email, strict_email: true, presence: true
   before_validation -> { sanitize_email(:email) }
 
   scope :pending, -> { where('created_at > ?', (Time.zone.now - EXPIRATION_LIMIT)) }

app/models/invite.rb

@@ -11,8 +11,7 @@ class Invite < ApplicationRecord
 
   validates :email, presence: true
   validates :email, uniqueness: { scope: :dossier_id }
-
-  validates :email, format: { with: Devise.email_regexp, message: "n'est pas valide" }, allow_nil: true
+  validates :email, strict_email: true, allow_nil: true
 
   scope :with_dossiers, -> { joins(:dossier).merge(Dossier.visible_by_user) }
 

app/models/user.rb

@@ -33,10 +33,14 @@ class User < ApplicationRecord
   accepts_nested_attributes_for :france_connect_information
 
   default_scope { eager_load(:instructeur, :administrateur, :expert) }
-  before_validation -> { sanitize_email(:email) }
 
+  before_validation -> { sanitize_email(:email) }
   validate :does_not_merge_on_self, if: :requested_merge_into_id_changed?
 
+  before_validation :remove_devise_email_format_validator
+  # plug our custom validation a la devise (same options) https://github.com/heartcombo/devise/blob/main/lib/devise/models/validatable.rb#L30
+  validates :email, strict_email: true, allow_blank: true, if: :devise_will_save_change_to_email?
+
   def validate_password_complexity?
     administrateur?
   end
@@ -268,4 +272,16 @@ class User < ApplicationRecord
   def link_invites!
     Invite.where(email: email).update_all(user_id: id)
   end
+
+  # we just want to remove the devise format validator
+  #   https://github.com/heartcombo/devise/blob/main/lib/devise/models/validatable.rb#L30
+  def remove_devise_email_format_validator
+    _validators[:email]&.reject! { _1.is_a?(ActiveModel::Validations::FormatValidator) }
+    _validate_callbacks.each do |callback|
+      next if !callback.filter.is_a?(ActiveModel::Validations::FormatValidator)
+      next if !callback.filter.attributes.include? :email
+
+      callback.filter.attributes.delete(:email)
+    end
+  end
 end

app/validators/strict_email_validator.rb

@@ -0,0 +1,32 @@
+class StrictEmailValidator < ActiveModel::EachValidator
+  # default devise email is : /\A[^@\s]+@[^@\s]+\z/
+  #   saying that it's quite permissive
+  #   but we want more, we want to ensure it's a domain with extension
+  #   so we append \.[A-Za-z]{2,}
+  REGEXP = /\A[^@\s]+@[^@\s\.]+\.[^@\s]{2,}\z/
+  DATE_SINCE_STRICT_EMAIL_VALIDATION = Date.parse(ENV.fetch('STRICT_EMAIL_VALIDATION_STARTS_ON')) rescue 0
+
+  def validate_each(record, attribute, value)
+    if value.present? && !regexp_for(record).match?(value)
+      record.errors.add(attribute, :invalid_email_format)
+    end
+  end
+
+  def regexp_for(record)
+    if StrictEmailValidator.eligible_to_new_validation?(record)
+      REGEXP
+    else
+      Devise.email_regexp
+    end
+  end
+
+  def self.eligible_to_new_validation?(record)
+    return false if !strict_validation_enabled?
+    return false if (record.created_at || Time.zone.now) < DATE_SINCE_STRICT_EMAIL_VALIDATION
+    true
+  end
+
+  def self.strict_validation_enabled?
+    ENV.key?('STRICT_EMAIL_VALIDATION_STARTS_ON')
+  end
+end