🛡️ Sentinel: [HIGH] Implement strict email validation
- Implemented `isValidEmail` utility with strict regex validation (rejects `<` and `>`) to prevent XSS vectors. - Updated `Contact.tsx` to use `isValidEmail` instead of weak regex. - Added comprehensive tests for `isValidEmail` in `src/utils/security.test.ts`. - Fixed flaky test in `src/pages/__tests__/Contact.test.tsx` by clearing `localStorage` in `afterEach`. - Added test case for invalid email submission. - Documented findings in `.jules/sentinel.md`. Co-authored-by: ragusa-it <196988693+ragusa-it@users.noreply.github.com>
This commit is contained in:
@@ -5,7 +5,7 @@ import { useTranslation } from "../i18n";
|
||||
import { useRateLimit } from "../hooks";
|
||||
import { config } from "../config";
|
||||
import { Button, Input, Textarea } from "../components/ui";
|
||||
import { sanitizeInput } from "../utils/security";
|
||||
import { sanitizeInput, isValidEmail } from "../utils/security";
|
||||
import styles from "./Contact.module.css";
|
||||
|
||||
const NAME_MAX_LENGTH = 100;
|
||||
@@ -53,7 +53,7 @@ export function Contact() {
|
||||
|
||||
if (!formData.email.trim()) {
|
||||
newErrors.email = "Required";
|
||||
} else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.email)) {
|
||||
} else if (!isValidEmail(formData.email)) {
|
||||
newErrors.email = "Invalid email";
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user