Merge pull request #13054 from demarche-numerique/security/profil-email-domain-anchor

ETQ tech, ancrer la vérification de domaine email sur le domaine complet

Author: mmagn

app/controllers/users/profil_controller.rb

@@ -115,7 +115,13 @@ def requested_email
     end
 
     def target_email_allowed?
-      LEGIT_ADMIN_DOMAINS.any? { |d| requested_email.end_with?(d) }
+      domain = requested_email.to_s.split('@', 2).last&.downcase
+      return false if domain.blank?
+
+      LEGIT_ADMIN_DOMAINS.any? do |d|
+        legit = d.to_s.downcase
+        domain == legit || domain.end_with?(".#{legit}")
+      end
     end
 
     def next_owner_email

spec/controllers/users/profil_controller_spec.rb

@@ -119,6 +119,16 @@
           expect(flash.alert).to include('contactez le support')
         end
       end
+
+      context 'when the requested email is on a domain that only matches a legit suffix without an `@` boundary' do
+        let(:requested_email) { 'admin@evilgouv.fr' }
+
+        it 'rejects the email change' do
+          expect(user.unconfirmed_email).to be_nil
+          expect(response).to redirect_to(profil_path)
+          expect(flash.alert).to include('contactez le support')
+        end
+      end
     end
 
     context 'when the user has an administrateur role but no instructeur role' do