Email validation enhancement

app/Http/Controllers/Auth/RegisteredUserController.php

@@ -37,7 +37,7 @@ public function store(Request $request): RedirectResponse
         $request->validate([
             'name' => ['required', 'string', 'max:255'],
             'username' => ['required', 'string', 'min:4', 'max:50', 'unique:'.User::class, new Username],
-            'email' => ['required', 'string', 'lowercase', 'email', 'max:255', 'unique:'.User::class, new UnauthorizedEmailProviders()],
+            'email' => ['required', 'string', 'lowercase', 'email:rfc,dns', 'max:255', 'unique:'.User::class, new UnauthorizedEmailProviders()],
             'password' => ['required', 'confirmed', Rules\Password::defaults()],
             'terms' => ['required', 'accepted'],
             'g-recaptcha-response' => app()->environment('production') ? ['required', new Recaptcha($request->ip())] : [],

app/Http/Requests/UserUpdateRequest.php

@@ -33,7 +33,7 @@ public function rules(): array
                 new Username($user),
             ],
             'email' => [
-                'required', 'string', 'lowercase', 'email', 'max:255', Rule::unique(User::class)->ignore($user->id),
+                'required', 'string', 'lowercase', 'email:rfc,dns', 'max:255', Rule::unique(User::class)->ignore($user->id),
                 new UnauthorizedEmailProviders(),
             ],
             'mail_preference_time' => [Rule::enum(UserMailPreference::class)],

tests/Http/Profile/EditTest.php

@@ -37,7 +37,7 @@
         ->patch('/profile', [
             'name' => 'Test User',
             'username' => 'testuser',
-            'email' => 'test@example.com',
+            'email' => 'test@laravel.com',
             'mail_preference_time' => 'daily',
             'prefers_anonymous_questions' => false,
         ]);
@@ -49,7 +49,7 @@
     $user->refresh();
 
     $this->assertSame('Test User', $user->name);
-    $this->assertSame('test@example.com', $user->email);
+    $this->assertSame('test@laravel.com', $user->email);
     $this->assertSame('testuser', $user->username);
     $this->assertNull($user->email_verified_at);
     $this->assertFalse($user->prefers_anonymous_questions);
@@ -78,6 +78,7 @@
 test('username can be updated to uppercase', function () {
     $user = User::factory()->create([
         'username' => 'testuser',
+        'email' => '[email protected]',
     ]);
 
     $response = $this
@@ -126,7 +127,9 @@
 });
 
 test('email verification status is unchanged when the email address is unchanged', function () {
-    $user = User::factory()->create();
+    $user = User::factory()->create([
+        'email' => '[email protected]',
+    ]);
 
     $response = $this
         ->actingAs($user)
@@ -147,13 +150,15 @@
 
 test('email verification job sent & status reset when the email address is changed', function () {
     Notification::fake();
-    $user = User::factory()->create();
+    $user = User::factory()->create([
+        'email' => '[email protected]',
+    ]);
 
     $this->actingAs($user)
         ->patch('/profile', [
             'name' => $user->name,
             'username' => 'valid_username',
-            'email' => 'new@email.address',
+            'email' => 'new@laravel.com',
             'prefers_anonymous_questions' => false,
         ])
         ->assertSessionHasNoErrors();
@@ -165,7 +170,9 @@
 
 test('only updates avatar if email changes & avatar not been uploaded', function () {
     Queue::fake();
-    $user = User::factory()->create();
+    $user = User::factory()->create([
+        'email' => '[email protected]',
+    ]);
 
     $this->actingAs($user)
         ->patch('/profile', [
@@ -327,6 +334,7 @@
 test('prefers_anonymous_questions can be updated', function () {
     $user = User::factory()->create([
         'prefers_anonymous_questions' => true,
+        'email' => '[email protected]',
     ]);
 
     $response = $this
@@ -462,3 +470,19 @@
         ->and($user->is_uploaded_avatar)->toBeFalse()
         ->and(session('flash-message'))->toBe('Updating avatar using GitHub.');
 });
+
+test('reject profile information update with fake email', function () {
+    $user = User::factory()->create();
+
+    $response = $this
+        ->actingAs($user)
+        ->patch('/profile', [
+            'name' => 'Test User',
+            'username' => 'testuser',
+            'email' => '[email protected]',
+            'mail_preference_time' => 'daily',
+            'prefers_anonymous_questions' => false,
+        ]);
+
+    $response->assertInvalid('email');
+});

tests/Http/Register/CreateTest.php

@@ -22,7 +22,7 @@
     $response = $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'm@9v_.*.XCN',
         'password_confirmation' => 'm@9v_.*.XCN',
         'terms' => true,
@@ -40,7 +40,7 @@
     $payload = [
         'name' => 'Test User',
         'username' => 'testuser',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'password',
         'password_confirmation' => 'password',
     ];
@@ -85,7 +85,7 @@
     $response = $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'password',
         'password_confirmation' => 'not-password',
     ]);
@@ -98,7 +98,7 @@
     $response = $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'password',
         'password_confirmation' => 'not-password',
         'terms' => false,
@@ -116,7 +116,7 @@
     $response = $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'password',
         'password_confirmation' => 'password',
     ]);
@@ -127,13 +127,13 @@
 
 test('email must be unique', function () {
     User::factory()->create([
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
     ]);
 
     $response = $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser1',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'password',
         'password_confirmation' => 'password',
     ]);
@@ -148,7 +148,7 @@
     $response = $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'pass',
         'password_confirmation' => 'pass',
     ]);
@@ -299,11 +299,31 @@
     $this->from('/register')->post('/register', [
         'name' => 'Test User',
         'username' => 'testuser1',
-        'email' => 'test@example.com',
+        'email' => 'test@laravel.com',
         'password' => 'password',
         'password_confirmation' => 'password',
         'terms' => true,
     ]);
 
     expect(User::first()->prefers_anonymous_questions)->toBeTrue();
 });
+
+test('reject fake emails', function () {
+    Http::fake([
+        'https://www.google.com/recaptcha/api/siteverify' => Http::response([
+            'success' => true,
+        ]),
+    ]);
+
+    $response = $this->from('/register')->post('/register', [
+        'name' => 'Test User',
+        'username' => 'testuser',
+        'email' => '[email protected]',
+        'password' => 'm@9v_.*.XCN',
+        'password_confirmation' => 'm@9v_.*.XCN',
+        'terms' => true,
+        'g-recaptcha-response' => 'valid',
+    ]);
+
+    $response->assertInvalid('email');
+});