From eaf49c10578ec5969dfbadfedc614c5a92d58b5f Mon Sep 17 00:00:00 2001
From: calixteman <calixte.denizet@gmail.com>
Date: Tue, 23 Dec 2025 23:13:09 +0100
Subject: [PATCH] Avoid to have a mail link with string having the format
 ddd@d.dddd

It fixes #20523.
---
 test/unit/autolinker_spec.js |  5 +++++
 web/autolinker.js            | 20 +++++++++++++++-----
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/test/unit/autolinker_spec.js b/test/unit/autolinker_spec.js
index a7755af67..2063e07f8 100644
--- a/test/unit/autolinker_spec.js
+++ b/test/unit/autolinker_spec.js
@@ -90,6 +90,10 @@ describe("autolinker", function () {
       ["partl@mail.boku.ac.at", "mailto:partl@mail.boku.ac.at"],
       ["Irene.Hyna@bmwf.ac.at", "mailto:Irene.Hyna@bmwf.ac.at"],
       ["<hi@foo.bar.baz>", "mailto:hi@foo.bar.baz"],
+      [
+        "foo@用户@例子.广告",
+        "mailto:%E7%94%A8%E6%88%B7@%E4%BE%8B%E5%AD%90.%E5%B9%BF%E5%91%8A",
+      ],
     ]);
   });
 
@@ -144,6 +148,7 @@ describe("autolinker", function () {
         "http//[]", // Empty IPv6 address.
         "abc.example.com", // URL without scheme.
         "JD?M$0QP)lKn06l1apKDC@\\qJ4B!!(5m+j.7F790m", // Not a valid email.
+        "262@0.302304", // Invalid domain.
       ].join("\n")
     );
     expect(matches.length).toEqual(0);
diff --git a/web/autolinker.js b/web/autolinker.js
index 85b7e8e28..a3045235e 100644
--- a/web/autolinker.js
+++ b/web/autolinker.js
@@ -133,10 +133,12 @@ class Autolinker {
 
   static #regex;
 
+  static #numericTLDRegex;
+
   static findLinks(text) {
     // Regex can be tested and verified at https://regex101.com/r/rXoLiT/2.
     this.#regex ??=
-      /\b(?:https?:\/\/|mailto:|www\.)(?:[\S--[\p{P}<>]]|\/|[\S--[\[\]]]+[\S--[\p{P}<>]])+|\b[\S--[@\p{Ps}\p{Pe}<>]]+@([\S--[\p{P}<>]]+(?:\.[\S--[\p{P}<>]]+)+)/gmv;
+      /\b(?:https?:\/\/|mailto:|www\.)(?:[\S--[\p{P}<>]]|\/|[\S--[\[\]]]+[\S--[\p{P}<>]])+|(?=\p{L})[\S--[@\p{Ps}\p{Pe}<>]]+@([\S--[\p{P}<>]]+(?:\.[\S--[\p{P}<>]]+)+)/gmv;
 
     const [normalizedText, diffs] = normalize(text, { ignoreDashEOL: true });
     const matches = normalizedText.matchAll(this.#regex);
@@ -150,11 +152,19 @@ class Autolinker {
         url.startsWith("https://")
       ) {
         raw = url;
-      } else if (URL.canParse(`http://${emailDomain}`)) {
-        raw = url.startsWith("mailto:") ? url : `mailto:${url}`;
-      } else {
-        continue;
+      } else if (emailDomain) {
+        const hostname = URL.parse(`http://${emailDomain}`)?.hostname;
+        if (!hostname) {
+          continue;
+        }
+        this.#numericTLDRegex ??= /\.\d+$/;
+        if (this.#numericTLDRegex.test(hostname)) {
+          // Skip emails with a numeric TLD as domain.
+          continue;
+        }
       }
+      raw ??= url.startsWith("mailto:") ? url : `mailto:${url}`;
+
       const absoluteURL = createValidAbsoluteUrl(raw, null, {
         addDefaultProtocol: true,
       });