Documentation
¶
Overview ¶
Package sanitize provides input validation and sanitization functions for user-supplied data.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Email ¶
Email reports whether email is an address and nothing else.
net/mail.ParseAddress implements the whole RFC 5322 mailbox grammar, so it also accepts "Admin <attacker@evil.com>" and "user@example.com (comment)" and returns the address it dug out. Callers store the string they validated rather than that extracted address, so anything that is not exactly the address is rejected here: otherwise a display name ends up in the email column, shown as the account's address while the mail goes elsewhere, and the exact-match uniqueness lookup treats it as a second, unrelated account.
A tombstone address is refused too. Erasure scrubs a user's email to "deleted-<uuid>@deleted.invalid", and email is a full unique column, so an address in that domain registered ahead of time squats the exact row erasure will later write. The scrub's UPDATE then fails with a unique violation and the whole erasure aborts, leaving the victim's identity in place; the user id is the JWT subject, so any relying party that has seen it can pre-squat. .invalid is RFC 2606 reserved and never a deliverable address, so refusing the tombstone domain turns away no legitimate registration.
func Locale ¶
Locale validates and normalizes a BCP 47 locale tag. Returns "en" for empty or invalid input.
func RedirectPath ¶
RedirectPath returns path unchanged when it is provably a same-origin relative path, and "" otherwise.
The rules mirror web/src/utils/safeRedirect.ts, the validator that runs last before router.push. This one runs first, and its output is what gets baked into an emailed verification link, so the two have to agree: a value only this side accepts becomes a dead link, and a value only this side accepts that some other consumer resolves differently becomes an open redirect.
Types ¶
This section is empty.
Source Files