improvement(utils): one email syntax gate, drop the backtracking placeholder regex

Audit follow-ups on the emails chip input.

- move EMAIL_SYNTAX_REGEX and the new @Domain pattern into @sim/utils/string as
  isValidEmailSyntax, so emcn and lib/messaging/email/validation.ts stop keeping
  byte-identical copies of the RFC 5322 regex
- allow single-label domains (@intranet) again — requiring a dot rejected
  entries the old startsWith('@') check accepted, which self-hosted
  deployments use. A lone @ and malformed labels stay rejected
- replace derivePlaceholderWithTags' /^Enter\s+(.+?)s?$/i with string ops;
  CodeQL flagged it as polynomial backtracking (js/redos). Verified identical
  output across the placeholder shapes in use
- forward the emails control's props explicitly instead of underscore-discard
  destructuring, matching ChipModalFileControl in the same file

Author: waleedlatif1

apps/sim/lib/messaging/email/validation.ts

@@ -1,3 +1,5 @@
+import { isValidEmailSyntax } from '@sim/utils/string'
+
 export interface EmailValidationResult {
   isValid: boolean
   reason?: string
@@ -38,15 +40,6 @@ const DISPOSABLE_DOMAINS = new Set([
   'yopmail.com',
 ])
 
-/**
- * Validates email syntax using RFC 5322 compliant regex
- */
-function validateEmailSyntax(email: string): boolean {
-  const emailRegex =
-    /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
-  return emailRegex.test(email) && email.length <= 254
-}
-
 /**
  * Checks if email is from a known disposable email provider
  */
@@ -78,7 +71,7 @@ export function quickValidateEmail(email: string): EmailValidationResult {
     disposable: false,
   }
 
-  checks.syntax = validateEmailSyntax(email)
+  checks.syntax = isValidEmailSyntax(email)
   if (!checks.syntax) {
     return {
       isValid: false,
@@ -136,9 +129,9 @@ export function quickValidateEmail(email: string): EmailValidationResult {
 
 /**
  * App-level policy for a single access-allowlist entry, applied on top of the
- * syntax gate in `ChipEmailsInput`. A bare `@domain` entry carries no local
- * part, so the address-level checks (disposable providers, suspicious patterns)
- * only apply to full addresses.
+ * caller's format gate. A bare `@domain` entry carries no local part, so the
+ * address-level checks (disposable providers, suspicious patterns) only apply
+ * to full addresses.
  *
  * @returns the rejection reason, or `null` when the entry is accepted.
  */

packages/emcn/src/components/chip-emails-input/chip-emails-input.tsx

@@ -1,39 +1,26 @@
 'use client'
 
 import * as React from 'react'
-import { normalizeEmail } from '@sim/utils/string'
+import { isValidEmailSyntax, normalizeEmail } from '@sim/utils/string'
 import { TagInput, type TagItem } from '../tag-input/tag-input'
 
-/**
- * Generic RFC 5322 email syntax gate. This is deliberately format-only —
- * app-specific policy (disposable domains, MX/DNS, membership rules) is the
- * consumer's concern and flows through the `validate` prop, keeping that logic
- * in the app rather than the design system.
- */
-const EMAIL_SYNTAX_REGEX =
-  /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
-
-/**
- * Bare `@domain.tld` pattern, accepted only when the consumer opts in via
- * `allowDomains` — for allowlists that grant access to a whole domain.
- */
-const EMAIL_DOMAIN_SYNTAX_REGEX =
-  /^@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+$/
-
-function isValidEmailSyntax(email: string, allowDomains: boolean): boolean {
-  if (email.length > 254) return false
-  return EMAIL_SYNTAX_REGEX.test(email) || (allowDomains && EMAIL_DOMAIN_SYNTAX_REGEX.test(email))
-}
+const ENTER_PREFIX = 'enter'
 
 /**
  * Derives the post-first-chip placeholder from the initial placeholder so
  * consumers don't have to spell both. Tries an `'Enter <noun>s'` →
  * `'Add <noun>'` singularize; falls back to a generic `'Add another'`.
+ *
+ * Deliberately string ops rather than a regex — `/^Enter\s+(.+?)s?$/` has
+ * polynomial backtracking on whitespace-heavy input (CodeQL js/redos).
  */
 function derivePlaceholderWithTags(placeholder: string): string {
-  const match = placeholder.match(/^Enter\s+(.+?)s?$/i)
-  if (match) return `Add ${match[1]}`
-  return 'Add another'
+  const rest = placeholder.slice(ENTER_PREFIX.length)
+  const noun = rest.trim()
+  const startsWithEnter = placeholder.slice(0, ENTER_PREFIX.length).toLowerCase() === ENTER_PREFIX
+  if (!startsWithEnter || rest === noun || !noun) return 'Add another'
+  const singular = noun.toLowerCase().endsWith('s') ? noun.slice(0, -1) : noun
+  return `Add ${singular}`
 }
 
 export interface ChipEmailsInputProps {

packages/emcn/src/components/chip-modal/chip-modal.tsx

@@ -730,20 +730,31 @@ function renderChipModalControl(
  * server-side submit failure).
  */
 function ChipModalEmailsControl({
-  type: _type,
-  title: _title,
-  required: _required,
-  hint: _hint,
-  flush: _flush,
-  className: _className,
+  value,
+  onChange,
+  validate,
+  allowDomains,
+  placeholder,
+  placeholderWithTags,
+  autoFocus,
+  disabled,
   error,
   errorId,
   id,
-  ...emailsProps
 }: ChipModalEmailsFieldProps & { id: string; errorId: string }) {
   return (
     <>
-      <ChipEmailsInput id={id} {...emailsProps} />
+      <ChipEmailsInput
+        id={id}
+        value={value}
+        onChange={onChange}
+        validate={validate}
+        allowDomains={allowDomains}
+        placeholder={placeholder}
+        placeholderWithTags={placeholderWithTags}
+        autoFocus={autoFocus}
+        disabled={disabled}
+      />
       {error && (
         <p id={errorId} role='alert' className={CHIP_MODAL_FIELD_ERROR_CLASS}>
           {error}

packages/utils/src/index.ts

@@ -34,6 +34,7 @@ export type { BackoffOptions } from './retry.js'
 export { backoffWithJitter, parseRetryAfter } from './retry.js'
 export { normalizeSSODomain } from './sso-domain.js'
 export {
+  isValidEmailSyntax,
   normalizeEmail,
   sanitizeForJsonb,
   sanitizeValueForJsonb,

packages/utils/src/string.ts

@@ -46,6 +46,32 @@ export function normalizeEmail(email: string): string {
   return email.trim().toLowerCase()
 }
 
+/**
+ * RFC 5322-shaped syntax gate for a full address. Format only — domain
+ * reputation, MX/DNS, and membership policy are the caller's concern.
+ */
+const EMAIL_SYNTAX_REGEX =
+  /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
+
+/**
+ * Bare `@domain` pattern, for allowlists that grant access to a whole domain.
+ * Single-label domains (`@intranet`) are allowed — self-hosted deployments use
+ * them — but a lone `@` and malformed labels are not.
+ */
+const EMAIL_DOMAIN_SYNTAX_REGEX =
+  /^@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
+
+/**
+ * Format-only email syntax check, capped at the RFC 5321 length limit.
+ *
+ * @param allowDomains - also accept a bare `@domain` entry, for allowlists that
+ * grant access to an entire domain rather than a single address.
+ */
+export function isValidEmailSyntax(email: string, allowDomains = false): boolean {
+  if (email.length > 254) return false
+  return EMAIL_SYNTAX_REGEX.test(email) || (allowDomains && EMAIL_DOMAIN_SYNTAX_REGEX.test(email))
+}
+
 /**
  * Matches UTF-16 code units that Postgres JSONB rejects: unpaired surrogate
  * halves (e.g. produced by `slice()` cutting an astral character like 𝐀 in