From 6b0e91798f0e908f1f1100fb2f80d35743a4080f Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Thu, 26 Mar 2026 00:49:35 +0100 Subject: [PATCH] Restrict email local part to safe characters only Remove backtick, curly braces, pipe, and slash from allowed characters. Keep underscore as it's commonly used and widely supported. --- backend/internal/api/handlers/users.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/internal/api/handlers/users.go b/backend/internal/api/handlers/users.go index 095f276..57edbe5 100644 --- a/backend/internal/api/handlers/users.go +++ b/backend/internal/api/handlers/users.go @@ -286,7 +286,7 @@ func (h *UserHandler) ListAll(c *gin.Context) { Success(c, users) } -var emailLocalPartRegex = regexp.MustCompile("^[a-zA-Z0-9!#$%&'*+\\-/=?^`{|}~-]+$") +var emailLocalPartRegex = regexp.MustCompile("^[a-zA-Z0-9!#$%&'*+\\-=?^_~-]+$") func validateEmailLocalPart(email string) error { parts := strings.Split(email, "@")