Repository: cnpm/cnpmjs.org (JavaScript)

Issue:
Leaking package author email address to pubic
Hi there.

The website https://cnpmjs.org is leaking package author's email addresses to pubic. Bots can scrape the site and can spam easily.

Take this example https://cnpmjs.org/~yyx990803
If you view source `view-source:https://cnpmjs.org/~yyx990803` of the page; you will find that email address is visible and has not been obfuscated.

Email addresses are also visible to Google (see screenshot)
![screenshot from 2018-08-19 09 23 16](https://user-images.githubusercontent.com/6111524/44305290-a0e8d900-a391-11e8-8aed-5957249bd676.png)

You should have been using packages like:
https://www.npmjs.com/package/obfooscator
Obfuscate strings ensure that spam bots can not harvest them.

The official npmjs site does not show email address at all. See
https://www.npmjs.com/~yyx990803

Thanks.



Discussion:
OK, I will change it as soon as possible. Thanks!
But stil can get email from the npm registry, like mine: http://registry.npmjs.com/-/user/org.couchdb.user:fengmk2
There are several other ways to find user email id, for example GitHub commit history.

I can submit a PR if you want.
I think i would only need to change the lines

https://github.com/cnpm/cnpmjs.org/blob/bd87907b69d3e65aa544930b5c7f04e75bdbc773/controllers/web/user/show.js#L37
and
https://github.com/cnpm/cnpmjs.org/blob/bd87907b69d3e65aa544930b5c7f04e75bdbc773/view/web/profile.html#L17



Patch:
diff --git a/controllers/web/user/show.js b/controllers/web/user/show.js
index ef8fdef87..d496d2582 100644
--- a/controllers/web/user/show.js
+++ b/controllers/web/user/show.js
@@ -4,6 +4,7 @@ var config = require('../../../config');
 var packageService = require('../../../services/package');
 var userService = require('../../../services/user');
 var common = require('../../../lib/common');
+var he = require('he');
 
 module.exports = function* showUser(next) {
   var name = this.params.name;
@@ -21,7 +22,9 @@ module.exports = function* showUser(next) {
 
   var data = {
     name: name,
-    email: user.email,
+    email: user.email ? he.encode(user.email, {
+      encodeEverything:true
+    }): user.email,
     json: user.json || {},
     isNpmUser: user.isNpmUser,
   };
diff --git a/package.json b/package.json
index f24320710..000549444 100644
--- a/package.json
+++ b/package.json
@@ -32,6 +32,7 @@
     "giturl": "^1.0.0",
     "graceful": "^1.0.1",
     "gravatar": "^1.6.0",
+    "he": "^1.2.0",
     "humanize-ms": "^1.2.1",
     "humanize-number": "~0.0.2",
     "is-type-of": "^1.2.0",


Test patch:
diff --git a/test/controllers/web/user/show.test.js b/test/controllers/web/user/show.test.js
index a154a9a1e..038856044 100644
--- a/test/controllers/web/user/show.test.js
+++ b/test/controllers/web/user/show.test.js
@@ -17,6 +17,7 @@
 
 var mm = require('mm');
 var request = require('supertest');
+var assert = require('assert');
 var app = require('../../../../servers/web');
 var config = require('../../../../config');
 var userService = require('../../../../services/user');
@@ -70,5 +71,16 @@ describe('controllers/web/user/show.test.js', function () {
       .expect(/<div id="profile">/)
       .expect(/Packages by/, done);
     });
+
+    it('should obfuscate user email address', function (done) {
+      request(app)
+        .get('/~cnpmjstest10')
+        .expect(200)
+        .then(function (res) {
+          assert(res.text.includes("fengmk2@gmail.com") === false);
+          done()
+        });
+    });
+
   });
 });