Fix/email format

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    decidim-friendly_signup (0.4.5)
+    decidim-friendly_signup (0.4.6)
       decidim-core (~> 0.27)
 
 GEM
@@ -796,6 +796,7 @@ GEM
 PLATFORMS
   arm64-darwin-21
   arm64-darwin-22
+  arm64-darwin-23
   x86_64-darwin-20
   x86_64-linux
 
@@ -818,4 +819,4 @@ RUBY VERSION
    ruby 3.0.2p107
 
 BUNDLED WITH
-   2.4.9
+   2.5.11

app/forms/concerns/decidim/friendly_signup/registration_form_override.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Decidim
+  module FriendlySignup
+    class RegistrationFormOverride < Decidim::RegistrationForm
+      validate :no_special_characters_in_email
+
+      private
+
+      EMAIL_REGEX = /\A[^<>"']+@[a-zA-Z0-9\-.]+\.[a-zA-Z]{2,}/
+
+      def no_special_characters_in_email
+        errors.add(:email, :invalid) if email =~ EMAIL_REGEX
+      end
+    end
+  end
+end

lib/decidim/friendly_signup/version.rb

@@ -5,6 +5,6 @@ module Decidim
   module FriendlySignup
     DECIDIM_VERSION = "0.27.4"
     COMPAT_DECIDIM_VERSION = "~> 0.27"
-    VERSION = "0.4.5"
+    VERSION = "0.4.6"
   end
 end

spec/forms/registration_form_spec.rb

@@ -74,5 +74,17 @@ module Decidim
         end
       end
     end
+
+    context "when email contains a script tag" do
+      let(:email) { "<script>alert('XSS')</script>@example.org" }
+
+      it { is_expected.to be_invalid }
+
+      context "when email contains invalid characters" do
+        let(:email) { 'user"@example.org' }
+
+        it { is_expected.to be_invalid }
+      end
+    end
   end
 end