Restrict email local part to safe characters only

Remove backtick, curly braces, pipe, and slash from allowed characters.
Keep underscore as it's commonly used and widely supported.
This commit is contained in:
Christoph Haas 2026-03-26 00:49:35 +01:00
parent da037e9a79
commit 6b0e91798f

View file

@ -286,7 +286,7 @@ func (h *UserHandler) ListAll(c *gin.Context) {
Success(c, users)
}
var emailLocalPartRegex = regexp.MustCompile("^[a-zA-Z0-9!#$%&'*+\\-/=?^`{|}~-]+$")
var emailLocalPartRegex = regexp.MustCompile("^[a-zA-Z0-9!#$%&'*+\\-=?^_~-]+$")
func validateEmailLocalPart(email string) error {
parts := strings.Split(email, "@")