opensource/hoppscotch
3
0
Fork 0
mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-08-28 17:45:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(backend): reject path/query/fragment in SMTP URL validation (GHSA-v7q6-r45w-2c6r) (#6413)

Browse Source 
* fix(backend): reject path/query/fragment in SMTP URL validation

* refactor: fix ai feedbacks

* fix(backend): harden SMTP URL validation against parser differentials
This commit is contained in:
Mir Arif Hasan
2026-06-11 16:08:36 +06:00
committed by GitHub
parent 9cc980bc4f
commit 73a88c82b1
1 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/hoppscotch-backend/src/utils.ts
+21 -4
View File
@@ -205,10 +205,27 @@ export const validateSMTPUrl = (url: string) => {
if (!url || url.length === 0) return false;
const regex =
/^(smtp|smtps):\/\/(?:([^:]+):([^@]+)@)?((?!\.)[^:]+)(?::(\d+))?$/;
if (regex.test(url)) return true;
return false;
if (/[\s\x00-\x1f\x7f]/.test(url)) return false;
if (/[?#\\]/.test(url)) return false;
if (url.endsWith(':')) return false;
let parsed: URL;
try {
parsed = new URL(url);
} catch {
return false;
}
// Only the SMTP schemes are permitted.
if (parsed.protocol !== 'smtp:' && parsed.protocol !== 'smtps:') return false;
if (parsed.pathname !== '' && parsed.pathname !== '/') return false;
if (parsed.search !== '' || parsed.hash !== '') return false;
// A hostname is required and must not start with a dot.
if (!parsed.hostname || parsed.hostname.startsWith('.')) return false;
// Port, when present, must be numeric (the URL parser already guarantees this).
return true;
};
/**