security: address REDOS by rejecting long emails

nmanousos / email-existence

108 stars 54 forks source link

security: address REDOS by rejecting long emails #37

Closed davisjam closed 6 years ago

davisjam commented 6 years ago

The email regex /^\S+@\S+$/ is vulnerable to REDOS on very long emails. Emails should not be longer than 300 characters per the RFC errata. Reject emails longer than this.