{"record":{"id":"cb9cdfb74fcad6e5","repo":"plandex-ai/plandex","slug":"invalid-email-v","errorCode":null,"errorMessage":"invalid email: %v","messagePattern":"invalid email: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/server/db/user_helpers.go","lineNumber":135,"sourceCode":"\n\tuserIds := make([]string, len(orgUsers))\n\tfor i, ou := range orgUsers {\n\t\tuserIds[i] = ou.UserId\n\t}\n\n\terr = Conn.Select(&users, \"SELECT * FROM users WHERE id = ANY($1)\", pq.Array(userIds))\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing users: %v\", err)\n\t}\n\n\treturn users, nil\n}\n\nfunc CreateUser(name, email string, tx *sqlx.Tx) (*User, error) {\n\temailSplit := strings.Split(email, \"@\")\n\tif len(emailSplit) != 2 {\n\t\treturn nil, fmt.Errorf(\"invalid email: %v\", email)\n\t}\n\tdomain := emailSplit[1]\n\n\tuser := User{\n\t\tName:   name,\n\t\tEmail:  email,\n\t\tDomain: domain,\n\t}\n\n\terr := tx.QueryRow(\"INSERT INTO users (name, email, domain) VALUES ($1, $2, $3) RETURNING id\", user.Name, user.Email, user.Domain).Scan(&user.Id)\n\n\tif err != nil {\n\t\tif IsNonUniqueErr(err) {\n\t\t\treturn nil, fmt.Errorf(\"user already exists for email: %v\", email)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error creating user: %v\", err)\n\t}\n","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/db/user_helpers.go#L117-L153","documentation":"CreateUser validates the email by splitting on '@' and requires exactly two parts (local and domain). Any email with zero or multiple '@' characters fails this check and returns this error before any DB work happens.","triggerScenarios":"Calling CreateUser (via CreateAccount) with an email string that does not contain exactly one '@', e.g. empty string, 'userexample.com', or 'a@@b.com'.","commonSituations":"Sign-up form submitted without email validation, email field empty after trimming, or copying emails with encoded '@' (%40) not decoded.","solutions":["Validate the email on the client/server request handler before calling CreateAccount/CreateUser","Use a regex or net/mail.ParseAddress to check the format before insertion","Decode and trim the incoming request body's Email field (handle %40, whitespace)","Return a 400 to the user asking them to correct the email"],"exampleFix":"// before\ndb.CreateUser(name, \"jane@example\", tx) // no '@' → error\n// after\naddr, err := mail.ParseAddress(email)\nif err != nil { return nil, errors.New(\"invalid email supplied\") }\ndb.CreateUser(name, addr.Address, tx)","handlingStrategy":"validation","validationCode":"func validEmail(email string) bool {\n    return strings.Count(email, \"@\") == 1 && len(strings.Split(email, \"@\")[1]) > 0\n}\n// call CreateUser only if validEmail(email)","typeGuard":null,"tryCatchPattern":"user, err := db.CreateUser(name, email, tx)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"invalid email\") { return http.StatusBadRequest }\n    return http.StatusInternalServerError\n}","preventionTips":["Validate email format at the API boundary (net/mail.ParseAddress or regex)","Trim and percent-decode incoming email values","Make the email field required and non-empty in request schemas","Share one email-validation helper between client and server"],"tags":["go","validation","email"],"backgroundTag":"invalid-email-format","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}