
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
This was originally built for Anonybuzz and is now used at StarTalent. This gem provides a robust mechanism to validate email addresses and restrict account creation to corporate email accounts.
This gem also ships with a data-set of free and disposable email domains which are used for validation checks.
You can also block certain usernames from creating accounts. Examples: admin, root
Add this line to your application's Gemfile:
gem "email_check"
To validate just the format of the email address
class User < ActiveRecord::Base
validates_email :email
end
To validate that the domain has a MX record:
validates_email :email, check_mx: true
To validate that the email is not from a disposable or free email provider:
validates_email :email, not_disposable:true, not_free:true
To validate that the domain is not blacklisted:
validates_email :email, not_blacklisted:true
To validate that the username is not blocked
validates_email :email, block_special_usernames:true
Everything together:
validates_email :email,
check_mx: true,
not_disposable:true,
not_free:true,
not_blacklisted:true,
block_special_usernames:true,
message: "Please register with your corporate email"
To turn everything on by default, you can use the validates_email_strictness helper.
# Example above
validates_email_strictness :email
# Everything but allow free emails. This is what most people would want to use
validates_email_strictness :email, not_free:false
The lists are exposed as assignable arrays so you can customize them or load whatever data you please.
Add a config/intializers/email_check.rb
# Set disposable email domains
EmailCheck.disposable_email_domains = ['freemail.org']
# Append to the whitelist
EmailCheck.whitelisted_domains << 'gmail.com'
EmailCheck.free_email_domains << 'thenewgmail.com'
# Setting a domain in the blacklist will also blacklist all subdomains
EmailCheck.blacklisted_domains << 'lvh.me'
# Block the 'anonymous' username for all domains
EmailCheck.blocked_usernames << 'anonymous'
This gem is tested with Rails 4.0+. Ruby versions tested:
Rails versions tested: Rails 4.0 Rails 5.0 Rails 6.0
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that email_check demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.