feat(security): enhance email validation and sanitization
- Updates `isValidEmail` to strictly reject double quotes and backticks while allowing apostrophes. - Applies `sanitizeInput` to email fields in Contact form payload (Defense in Depth). - Adds tests for email validation edge cases. - Updates Sentinel journal. Co-authored-by: ragusa-it <196988693+ragusa-it@users.noreply.github.com>
This commit is contained in:
@@ -93,7 +93,7 @@ export function Contact() {
|
||||
try {
|
||||
const templateParams = {
|
||||
name: sanitizeInput(formData.name),
|
||||
email: formData.email, // Email doesn't typically need HTML sanitization if validated by regex, but good practice to handle it if used in HTML context.
|
||||
email: sanitizeInput(formData.email),
|
||||
title: sanitizeInput(formData.subject),
|
||||
message: sanitizeInput(formData.message),
|
||||
reply_to: formData.email,
|
||||
|
||||
Reference in New Issue
Block a user