Files
discourse/lib/validators
Ted Johansson 60a3fe41d2 FIX: Disallow encoded words in e-mail addresses (#33083)
RFC 5322 allows special characters, including ? and =, to be used in e-mail addresses.

RFC 2047 is an extension that adds a feature called "encoded words" which let you embed different encodings in the same header. However, it explicitly says that these aren't allowed in e-mail address headers.

Encoded words have the format:

encoded-word = "=?" charset "?" encoding "?" encoded-text "?="
Where encoding is either Q or B, but could take on other values in the future.

After this change we consider e-mail addresses with an encoded word inside invalid.
2025-06-05 12:58:01 +08:00
..