RocketChat / RocketChat/Rocket.Chat
corrupted entries in emailDomainDefaultBlackList (fused, truncated, duplicates)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
The file apps/meteor/app/lib/server/lib/defaultBlockedDomainsList.ts contains corrupted entries in the emailDomainDefaultBlackList array. Two domain names were accidentally joined into one string without a separator, creating entries that will never match any real email domain and silently fail to block disposable email registrations.
Steps to reproduce:
Run this from the apps/meteor directory:
node /tmp/v.js
Expected behavior:
Every entry should be a valid standalone domain name that correctly blocks
registration from disposable email services.
Actual behavior:
Fused entries — two domains merged into one string, will never match anything:
Truncated entry — missing TLD, will never match anything:
Duplicate entries — exact same string appears twice:
Impact:
Because the fused entries are syntactically valid strings, no TypeScript or lint error is thrown. The bug is completely silent. A user can bypass email blocking
by registering with [test@mailmetrash.comilzilla.org](mailto:test@mailmetrash.comilzilla.org) and Rocket.Chat will accept it even though [mailmetrash.com](http://mailmetrash.com/) is explicitly in the blocklist.
Additional context:
The fix is to delete the 3 remaining fused lines (both halves already exist
correctly elsewhere in the list), fix viewcastmediae → [viewcastmedia.eu](http://viewcastmedia.eu/),
and remove one of each duplicate line.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with apps/meteor/app/lib/server/lib/defaultBlockedDomainsList.ts and inspect the emailDomainDefaultBlackList array. Run node /tmp/v.js from apps/meteor to review the reported entries. Done means the three fused lines, truncated domain, and duplicate entries are corrected or removed, with every remaining entry a valid standalone domain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100