fix: add stricter rules for the admin email field#441
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds SMTP admin email validation: a new SMTPConfiguration.Validate() parses AdminEmail, rejects addresses in netlify.com or netlify.app (including subdomains), and is invoked in CreateInstance and UpdateInstance when BaseConfig is provided, returning 400 on failure. A table-driven test covers allowed, reserved, subdomain, invalid, empty, and quoted-local-part cases. Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
conf/configuration_test.go (1)
33-39: ⚡ Quick winAdd a regression case for quoted local-parts containing
@.Please add a case like
"\"a@b\"@netlify.com"expecting an error, so this bypass path stays covered long-term.🧪 Suggested test case addition
{ {"", false}, // empty is fine {"noreply@example.com", false}, // valid non-Netlify domain {"team@netlify.com", true}, // reserved domain {"user@netlify.app", true}, // reserved domain {"user@sub.netlify.com", true}, // subdomain of reserved + {"\"a@b\"@netlify.com", true}, // quoted local-part with '@' must still be blocked {"not-an-email", true}, // invalid format }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@conf/configuration_test.go` around lines 33 - 39, Add a regression test entry for quoted local-parts containing @ by inserting the case {"\"a@b\"@netlify.com", true} into the existing test cases array in configuration_test.go (the same table with entries like {"noreply@example.com", false} and {"team@netlify.com", true}) so the validation logic that handles quoted local-parts is exercised and expected to error; ensure the string is properly escaped in the Go source.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/instance.go`:
- Around line 111-115: CreateInstance currently skips SMTP validation allowing
bypass of reserved-domain rules; add the same SMTP config validation used in the
update path by invoking params.BaseConfig.SMTP.Validate() inside CreateInstance
(the same check you see in the UpdateInstance branch) and return
badRequestError("Invalid SMTP configuration: %v", err) on failure so
BaseConfig.SMTP.AdminEmail is enforced at creation time as well.
In `@conf/configuration.go`:
- Around line 297-305: The current validation uses strings.Split(addr.Address,
"@") which fails for quoted local-parts containing '@' (e.g.,
"\"a@b\"@netlify.com") and thus skips reserved-domain checks; change the logic
in the block that reads addr.Address to find the last '@' using
strings.LastIndex, if idx >= 0 extract domain :=
strings.ToLower(addr.Address[idx+1:]), then iterate over reservedDomains and use
domain == reserved or strings.HasSuffix(domain, "."+reserved) to return the same
error; also handle the case idx < 0 by skipping validation (or treating as
invalid per existing behavior) so behavior is correct for RFC5322 addresses.
---
Nitpick comments:
In `@conf/configuration_test.go`:
- Around line 33-39: Add a regression test entry for quoted local-parts
containing @ by inserting the case {"\"a@b\"@netlify.com", true} into the
existing test cases array in configuration_test.go (the same table with entries
like {"noreply@example.com", false} and {"team@netlify.com", true}) so the
validation logic that handles quoted local-parts is exercised and expected to
error; ensure the string is properly escaped in the Go source.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bfcb455c-1810-4382-8b44-d74e3e002906
📒 Files selected for processing (3)
api/instance.goconf/configuration.goconf/configuration_test.go
2 participants
- Summary
Adds validation to
SMTPConfigurationthat rejectsadmin_emailvalues using Netlify-owned domains (netlify.com,netlify.app), closing a vulnerability where an attacker could send SPF/DKIM/DMARC-authenticated phishing emails fromteam@netlify.comvia Netlify's mail infrastructure. Validation runs at update time inUpdateInstanceand covers exact domain matches, subdomains, and invalid email formats.- Test plan
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)