Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Change e-mail domain blocks to block IPs dynamically (#17635)

Browse source 
* Change e-mail domain blocks to block IPs dynamically

* Update app/workers/scheduler/email_domain_block_refresh_scheduler.rb

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>

* Update app/workers/scheduler/email_domain_block_refresh_scheduler.rb

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>
This commit is contained in:
Eugen Rochko 2022-02-24 17:28:23 +01:00 • committed by GitHub
parent 91cc8d1e63
commit a29a982eaa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
20 changed files with 322 additions and 157 deletions
Download patch file Download diff file Expand all files Collapse all files

26
app/validators/blacklisted_email_validator.rb
View file

@ -4,41 +4,39 @@ class BlacklistedEmailValidator < ActiveModel::Validator
def validate(user)
return if user.valid_invitation? || user.email.blank?
@email = user.email
user.errors.add(:email, :blocked) if blocked_email_provider?
user.errors.add(:email, :taken) if blocked_canonical_email?
user.errors.add(:email, :blocked) if blocked_email_provider?(user.email, user.sign_up_ip)
user.errors.add(:email, :taken) if blocked_canonical_email?(user.email)
end
private
def blocked_email_provider?
disallowed_through_email_domain_block? || disallowed_through_configuration? || not_allowed_through_configuration?
def blocked_email_provider?(email, ip)
disallowed_through_email_domain_block?(email, ip) || disallowed_through_configuration?(email) || not_allowed_through_configuration?(email)
end
def blocked_canonical_email?
CanonicalEmailBlock.block?(@email)
def blocked_canonical_email?(email)
CanonicalEmailBlock.block?(email)
end
def disallowed_through_email_domain_block?
EmailDomainBlock.block?(@email)
def disallowed_through_email_domain_block?(email, ip)
EmailDomainBlock.block?(email, attempt_ip: ip)
end
def not_allowed_through_configuration?
def not_allowed_through_configuration?(email)
return false if Rails.configuration.x.email_domains_whitelist.blank?
domains = Rails.configuration.x.email_domains_whitelist.gsub('.', '\.')
regexp = Regexp.new("@(.+\\.)?(#{domains})$", true)
@email !~ regexp
email !~ regexp
end
def disallowed_through_configuration?
def disallowed_through_configuration?(email)
return false if Rails.configuration.x.email_domains_blacklist.blank?
domains = Rails.configuration.x.email_domains_blacklist.gsub('.', '\.')
regexp = Regexp.new("@(.+\\.)?(#{domains})", true)
regexp.match?(@email)
regexp.match?(email)
end
end

20
app/validators/email_mx_validator.rb
View file

@ -11,11 +11,11 @@ class EmailMxValidator < ActiveModel::Validator
if domain.blank?
user.errors.add(:email, :invalid)
elsif !on_allowlist?(domain)
ips, hostnames = resolve_mx(domain)
resolved_ips, resolved_domains = resolve_mx(domain)
if ips.empty?
if resolved_ips.empty?
user.errors.add(:email, :unreachable)
elsif on_blacklist?(hostnames + ips)
elsif on_blacklist?(resolved_domains, resolved_ips, user.sign_up_ip)
user.errors.add(:email, :blocked)
end
end
@ -40,24 +40,24 @@ class EmailMxValidator < ActiveModel::Validator
end
def resolve_mx(domain)
hostnames = []
ips = []
records = []
ips = []
Resolv::DNS.open do |dns|
dns.timeouts = 5
hostnames = dns.getresources(domain, Resolv::DNS::Resource::IN::MX).to_a.map { |e| e.exchange.to_s }
records = dns.getresources(domain, Resolv::DNS::Resource::IN::MX).to_a.map { |e| e.exchange.to_s }
([domain] + hostnames).uniq.each do |hostname|
([domain] + records).uniq.each do |hostname|
ips.concat(dns.getresources(hostname, Resolv::DNS::Resource::IN::A).to_a.map { |e| e.address.to_s })
ips.concat(dns.getresources(hostname, Resolv::DNS::Resource::IN::AAAA).to_a.map { |e| e.address.to_s })
end
end
[ips, hostnames]
[ips, records]
end
def on_blacklist?(values)
EmailDomainBlock.where(domain: values.uniq).any?
def on_blacklist?(domains, resolved_ips, attempt_ip)
EmailDomainBlock.block?(domains, ips: resolved_ips, attempt_ip: attempt_ip)
end
end