Merge pull request #11735 from keymanapp/fix/developer/11362-verify-e…

…mail-addresses-in-package

fix(developer): verify email addresses in .kps and .keyboard_info

developer/src/common/web/utils/index.ts

@@ -2,4 +2,5 @@ export { validateMITLicense } from './src/validate-mit-license.js';
 export { KeymanSentry, SentryNodeOptions } from './src/KeymanSentry.js';
 export { getOption, loadOptions, clearOptions } from './src/options.js';
 export { escapeMarkdownChar } from './src/markdown.js';
-export { KeymanUrls } from './src/keyman-urls.js';
+export { KeymanUrls } from './src/keyman-urls.js';
+export { isValidEmail } from './src/is-valid-email.js';

developer/src/common/web/utils/src/is-valid-email.ts

@@ -0,0 +1,18 @@
+/*
+ * Keyman is copyright (C) SIL International. MIT License.
+ *
+ * Verify email address format, following WHATWG guidelines
+ */
+
+// There is no "good" definition of a valid email address. Email addresses are
+// horrific. They can contain comments, whitespace, and all manner of ugly
+// things. Because we use AJV to verify JSON files, we use their specification
+// on what is a valid email address. Some useful references:
+// * https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address
+// * http://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address#answer-8829363
+// * https://github.com/ajv-validator/ajv-formats/blob/4ca86d21bd07571a30178cbb3714133db6eada9a/src/formats.ts#L122
+// * https://github.com/ajv-validator/ajv-formats/blob/4ca86d21bd07571a30178cbb3714133db6eada9a/src/formats.ts#L65
+
+export function isValidEmail(email: string) {
+  return /^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(email);
+}

developer/src/common/web/utils/test/test-is-valid-email.ts

@@ -0,0 +1,35 @@
+import { assert } from 'chai';
+import 'mocha';
+import { isValidEmail } from '../src/is-valid-email.js';
+
+describe('test-is-valid-email', function () {
+  it('should accept a valid email address', function() {
+    [
+      '[email protected]',
+      '[email protected]',
+      '[email protected]',
+      '[email protected]',
+      '[email protected]',
+      '[email protected]',
+      '[email protected]'
+    ].forEach(email => assert.isTrue(isValidEmail(email), `expected '${email}' to be valid`));
+
+    // This is accepted, but it's really a bit wonky. But that's an upstream
+    // issue with overly lax regex and not something we'll attempt to fix:
+    //
+    // assert.isTrue(isValidEmail('[email protected]'));
+  });
+
+  it('should reject invalid email addresses', function() {
+    [
+      '[email protected], [email protected]',
+      '<Mr Email> [email protected]',
+      'email@example_domain.com',
+      'email',
+      'email@.',
+      '[email protected]',
+      'email@',
+      '@example',
+    ].forEach(email => assert.isFalse(isValidEmail(email), `expected '${email}' to be invalid`));
+  });
+});

developer/src/kmc-keyboard-info/src/keyboard-info-compiler.ts

@@ -8,7 +8,7 @@ import { KeyboardInfoFile, KeyboardInfoFileIncludes, KeyboardInfoFileLanguageFon
 import { KeymanFileTypes, CompilerCallbacks, KmpJsonFile, KmxFileReader, KMX, KeymanTargets, KeymanCompiler, CompilerOptions, KeymanCompilerResult, KeymanCompilerArtifacts, KeymanCompilerArtifact } from "@keymanapp/common-types";
 import { KeyboardInfoCompilerMessages } from "./keyboard-info-compiler-messages.js";
 import langtags from "./imports/langtags.js";
-import { KeymanUrls, validateMITLicense } from "@keymanapp/developer-utils";
+import { KeymanUrls, isValidEmail, validateMITLicense } from "@keymanapp/developer-utils";
 import { KmpCompiler } from "@keymanapp/kmc-package";
 
 import { SchemaValidators } from "@keymanapp/common-types";
@@ -238,6 +238,11 @@ export class KeyboardInfoCompiler implements KeymanCompiler {
           return null;
         }
 
+        if(!isValidEmail(match[2])) {
+          this.callbacks.reportMessage(KeyboardInfoCompilerMessages.Error_InvalidAuthorEmail({email:author.url}));
+          return null;
+        }
+
         keyboard_info.authorEmail = match[2];
       }
     }

developer/src/kmc-keyboard-info/test/fixtures/multiple-email-addresses/LICENSE.md

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2022 SIL International
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

developer/src/kmc-keyboard-info/test/fixtures/multiple-email-addresses/build/.gitattributes

@@ -0,0 +1 @@
+khmer_angkor.js -text