CVE-2023-34099 (PHP, published 2023-06-27T17:15Z)
Description: value: Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/shopware5/shopware
Files changed:
.phpstan-baseline.neon
engine/Shopware/Components/Validator/EmailValidator.php
tests/Unit/Components/EmailValidatorTest.php
Commit message: SW-27102 - changing custom email validation to PHPs FILTER_VALIDATE_EMAIL


Vulnerable code:
		-
			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:getValidEmails\\(\\) has no return type specified\\.$#"
			count: 1
			path: tests/Unit/Components/EmailValidatorTest.php

		-
			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:getinvalidEmails\\(\\) has no return type specified\\.$#"
			count: 1
			path: tests/Unit/Components/EmailValidatorTest.php

		-
			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:testInvalidEmails\\(\\) has no return type specified\\.$#"
			count: 1
			path: tests/Unit/Components/EmailValidatorTest.php

		-
			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:testValidEmails\\(\\) has no return type specified\\.$#"
			count: 1
			path: tests/Unit/Components/EmailValidatorTest.php

        // Inspired by the regex used in symfony/validator
        // See: https://github.com/symfony/validator/blob/dae70b74fe173461395cfd61a5c5245e05e511f5/Constraints/EmailValidator.php#L72
        return (bool) preg_match('/^\S+\@\S+\.\S+$/', $emailAddress);
    /**
     * @var EmailValidator
     */
    private $SUT;
    public function getValidEmails()
            ['test@example.de'],
            ['test@example.com'],
            ['test@example.org'],
            ['test@example.berlin'],
            ['test@example.email'],
            ['test@example.systems'],
            ['test@example.active'],
            ['test@example.love'],
            ['test@example.video'],
            ['test@example.app'],
            ['test@example.shop'],
            ['disposable.style.email.with+symbol@example.com'],
            ['other.email-with-dash@example.com'],

            // We will ignore quoted string local parts
            // this would blow up the simple regex method
            // array('"much.more unusual"@example.com'),
     *
     * @param string $email
    public function testValidEmails($email)
    public function getinvalidEmails()
            ['test'],
            ['test@.de'],
            ['@example'],
            ['@example.de'],
            ['@.'],
            [' @foo.de'],
            ['@foo.'],
            ['foo@ .de'],
            ['foo@bar. '],
     *
     * @param string $email
    public function testInvalidEmails($email)

Fixed code:
        return (bool) filter_var($emailAddress, FILTER_VALIDATE_EMAIL);
    private EmailValidator $SUT;
    /**
     * @return array<string, array<int, string>>
     */
    public function getValidEmails(): array
            'test@example.de' => ['test@example.de'],
            'test@example.com' => ['test@example.com'],
            'test@example.org' => ['test@example.org'],
            'test@example.berlin' => ['test@example.berlin'],
            'test@example.email' => ['test@example.email'],
            'test@example.systems' => ['test@example.systems'],
            'test@example.active' => ['test@example.active'],
            'test@example.love' => ['test@example.love'],
            'test@example.video' => ['test@example.video'],
            'test@example.app' => ['test@example.app'],
            'test@example.shop' => ['test@example.shop'],
            'disposable.style.email.with+symbol@example.com' => ['disposable.style.email.with+symbol@example.com'],
            'other.email-with-dash@example.com' => ['other.email-with-dash@example.com'],
            '"much.more.unusual"@example.com' => ['"much.more.unusual"@example.com'],
            '!#$%&*+-/=?^_`.{|}~@example.com' => ['!#$%&*+-/=?^_`.{|}~@example.com'],
    public function testValidEmails(string $email): void
    /**
     * @return array<string, array<int, string>>
     */
    public function getInvalidEmails(): array
            'test' => ['test'],
            'test@.de' => ['test@.de'],
            '@example' => ['@example'],
            '@example.de' => ['@example.de'],
            '@.' => ['@.'],
            ' @foo.de' => [' @foo.de'],
            '@foo.' => ['@foo.'],
            'foo@ .de' => ['foo@ .de'],
            'foo@bar. ' => ['foo@bar. '],
            "testing@example.com'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(" => ["testing@example.com'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR("],
            "testing@example.com'||''||'" => ["testing@example.com'||''||'"],
            "testing@example.com'|||'" => ["testing@example.com'|||'"],
            "testing@example.com'||'" => ["testing@example.com'||'"],
            'test@example.com|' => ['test@example.com|'],
            'test@example.com(' => ['test@example.com('],
            'test@example.com"' => ['test@example.com"'],
    public function testInvalidEmails(string $email): void