Skip to main content

Lack of data validation - Emails

Need​

Implementation of email address validation to prevent the use of disposable mailboxes

Context​

  • Usage of Scala for building scalable and functional applications
  • Usage of play.api.data for handling form data in Play Framework
  • Usage of play.api.data.Forms for handling form data in Play Framework

Description​

Non compliant code​

import play.api.data._
import play.api.data.Forms._

val userForm = Form(
  mapping(
    "email" -> email,
    "password" -> nonEmptyText
  )(User.apply)(User.unapply)
)

In the above Scala code, we are using the Play framework's Form functionality to create a form for user registration. The form has two fields: "email" and "password".

The "email" field uses the built-in 'email' validation, which only checks if the input is in the format of an email. It does not check whether the email is from a disposable mailbox like 'yopmail'.

This lack of validation allows users to register with disposable emails, which can lead to various security issues. For instance, it can be exploited for spamming, fake account creation, or avoiding account responsibility.

The vulnerability lies in the fact that the application does not control or validate that server-side emails used to register users do not belong to disposable mailboxes. This could be fixed by adding additional validation to the email field to check for disposable email addresses.

Steps​

  • Implement server-side email validation to check if the email belongs to a disposable mailbox.
  • Use a reliable email validation library or regex pattern to validate the email format.
  • Consider implementing additional checks such as domain validation to ensure the email is from a valid domain.
  • Display appropriate error messages to the user if the email is invalid or belongs to a disposable mailbox.
  • Consider implementing rate limiting or CAPTCHA to prevent abuse of the email validation process.

Compliant code​

import play.api.data._
import play.api.data.Forms._
import play.api.data.validation.Constraints._

val userForm = Form(
  mapping(
    "email" -> email.verifying("Invalid email", email => isValidEmail(email)),
    "password" -> nonEmptyText
  )(User.apply)(User.unapply)
)

def isValidEmail(email: String): Boolean = {
  val emailRegex = "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\\\.[a-zA-Z]{2,6}$"
  val pattern = java.util.regex.Pattern.compile(emailRegex)
  val disposableEmailDomains = List("yopmail.com", "mailinator.com", "guerrillamail.com") // Add more disposable email domains as needed

  pattern.matcher(email).matches() && !disposableEmailDomains.exists(domain => email.endsWith(domain))
}

The above code fixes the vulnerability by adding a server-side email validation to the user registration form. The isValidEmail function checks if the email is in a valid format and does not belong to a disposable mailbox.

The emailRegex is a regular expression that matches a valid email format. It checks if the email contains only alphanumeric characters, periods, percent signs, plus signs, or hyphens, followed by an @ symbol, followed by more alphanumeric characters, periods, or hyphens, and ending with a period and between 2 to 6 alphabetic characters.

The disposableEmailDomains list contains domains of disposable mailboxes. If the email ends with any of these domains, the isValidEmail function will return false, indicating that the email is invalid.

The verifying method is used to add a constraint to the email field in the form. If the isValidEmail function returns false, the form will be invalid, and an "Invalid email" error message will be displayed to the user.

This solution helps to prevent users from registering with disposable emails, thus reducing the risk of spam or abuse. It's also recommended to implement additional security measures such as rate limiting or CAPTCHA to further prevent abuse of the email validation process.

References​

Last updated on