Development

docker/routlin-dash/app/sanitize.py

@@ -199,8 +199,11 @@ def time_24h(value, max_len=5):
     return _strip(value, r'[^0-9:]', max_len)
 
 def email(value, max_len=254):
-    """Email address: letters, digits, @, dot, hyphen, underscore, plus. Lowercased."""
-    return _strip(value.lower(), r'[^a-z0-9@.\-_+]', max_len)
+    """Email address: strict format check. Returns lowercased address or empty string."""
+    s = str(value).strip().lower()[:max_len]
+    if re.fullmatch(r'[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,}', s):
+        return s
+    return ''
 
 def timezone(value):
     """Timezone string: must be in VALID_TIMEZONES list. Returns '' if not found."""