{"record":{"id":"e27175439a38c5ae","repo":"SonarSource/sonarqube","slug":"address-contains-invalid-character-0x-02x","errorCode":null,"errorMessage":"Address contains invalid character: 0x%02x","messagePattern":"Address contains invalid character: 0x%02x","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/sonar-server-common/src/main/java/org/sonar/server/notification/email/EmailNotificationChannel.java","lineNumber":279,"sourceCode":"  }\n\n  private void setToAndFrom(Email email, EmailMessage emailMessage) throws EmailException {\n    String fromName = configuration.getFromName();\n    String from = StringUtils.isBlank(emailMessage.getFrom()) ? fromName : (emailMessage.getFrom() + \" (\" + fromName + \")\");\n    email.setFrom(configuration.getFrom(), from);\n    validateAddress(emailMessage.getTo());\n    email.addTo(emailMessage.getTo(), \" \");\n  }\n\n  private static void validateAddress(String mailAddress) {\n    //validating that the email address does not contain CR or LF characters to prevent SMTP injection\n    final byte CR = '\\r';\n    final byte LF = '\\n';\n\n    for (char aChar : mailAddress.toCharArray()) {\n      byte b = (byte) aChar;\n      if (b == LF || b == CR) {\n        throw new IllegalArgumentException(\"Address contains invalid character: \" + String.format(\"0x%02x\", b));\n      }\n    }\n  }\n\n  @CheckForNull\n  private String resolveHost() {\n    try {\n      return new URI(server.getPublicRootUrl()).getHost();\n    } catch (URISyntaxException e) {\n      // ignore\n      return null;\n    }\n  }\n\n  private void setHeaders(Email email, EmailMessage emailMessage, @CheckForNull String host) {\n    // Set general information\n    email.setCharset(\"UTF-8\");\n    if (StringUtils.isNotBlank(host)) {","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-server-common/src/main/java/org/sonar/server/notification/email/EmailNotificationChannel.java#L261-L297","documentation":"EmailNotificationChannel.validateAddress rejects email addresses containing carriage return or line feed characters, which would enable SMTP header injection. It throws IllegalArgumentException with the offending byte's hex value.","triggerScenarios":"Adding a user whose email field contains \\r or \\n (e.g. pasted multi-line value, Ldap/SAML attribute with newlines), then sending a notification via setToAndFrom.","commonSituations":"User emails imported from LDAP/AD or CSV with trailing newline; API call creating users with embedded newlines in email; template bugs concatenating addresses with newlines.","solutions":["Sanitize the user's email field: strip/trim CR and LF characters at the source (user record, LDAP sync, or API input).","Check how the offending address was provisioned and fix the upstream data (AD attribute, CSV import).","Reject invalid emails at user-creation validation time with a clear message.","After fixing the user data, resend/resume notifications."],"exampleFix":"// before\nuser.setEmail(ldapAttribute); // may contain \"a@b.com\\n\"\n// after\nuser.setEmail(ldapAttribute.replaceAll(\"[\\\\r\\\\n]\", \"\").trim());","handlingStrategy":"validation","validationCode":"boolean isValidEmail(String email) { return email != null && !email.chars().anyMatch(c -> c == '\\r' || c == '\\n'); }","typeGuard":null,"tryCatchPattern":"try { emailChannel.deliver(payload); } catch (IllegalArgumentException e) { if (e.getMessage().startsWith(\"Address contains invalid character\")) { log.warn(\"Skipping notification: bad email address\"); return; } throw e; }","preventionTips":["Sanitize emails at ingestion (LDAP sync, CSV import, API)","Trim and strip CR/LF from all user emails on write","Add user-creation validation rejecting newlines in email"],"tags":["email","security","header-injection","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}