⚠️ Critical PrestaShop Alert: Attackers Can Take Control of Your Store via the Contact Form

These two branches receive an identical patch. The root cause of the vulnerability is the use of a regex with the $ anchor without the D modifier. In PHP, $ without /D accepts an optional line break at the end of the string, so an email like This email address is being protected from spambots. You need JavaScript enabled to view it.\n passed validation. This allows email header injection: an attacker can inject additional SMTP headers (Bcc:, Subject:…) into any transactional email the store sends using that field. The patch replaces the regex with three chained checks:

BEFORE (vulnerable code):

public static function isEmail($email)
{
    return preg_match('/^[a-z0-9!#$%&\'*+\/=?^`{}|~.-]+@[a-z0-9.-]+$/i', $email);
    // ↑ accepts \n at the end
}

AFTER (Validate-1_7.php patched):

public static function isEmail($email)
{
    if (empty($email)) {
        return false;
    }
    // RFC 5321: maximum 254 characters per address
    if (strlen($email) > 254) {
        return false;
    }
    // Explicitly block CR, LF, and TAB which allow header injection
    if (preg_match('/[\r\n\t]/', $email)) {
        return false;
    }
    // Double validation: PHP built-in + SwiftMailer RFC grammar
    return filter_var($email, FILTER_VALIDATE_EMAIL) !== false && Swift_Validate::email($email);
}

The two final validators are applied in series: filter_var rejects clearly invalid formats at minimal cost, and Swift_Validate::email() applies the complete RFC 5321 grammatical analysis before SwiftMailer uses the address to build the To: header.

Required dependency: swiftmailer/swiftmailer, which is already part of the PrestaShop 1.7 core.

In the 1.7.8 branch, PrestaShop already incorporates Symfony and the egulias/email-validator library. The patch takes advantage of these components to replace the previous double validation with a more expressive triple layer, although without yet activating Symfony's strict mode.

AFTER (Validate-1_7_8.php patched):

public static function isEmail($email)
{
    if (empty($email)) {
        return false;
    }
    // Layer 1: Symfony Email constraint (lax mode)
    $validator = Validation::createValidator();
    $errors = $validator->validate($email, new Email());
    if (count($errors) > 0) {
        return false;
    }
    // Layers 2 and 3: RFC 5322 + SwiftMailer compatibility
    return !empty($email) && (new EmailValidator())->isValid($email, new MultipleValidationWithAnd([
        new RFCValidation(),
        new SwiftMailerValidation(),
    ]));
}

The three layers have distinct responsibilities:

• Symfony - RFCValidation: Compliance with RFC 5321/5322 via the egulias/email-validator parser; detects syntactically valid but problematic formats in production.
• SwiftMailerValidation: Guarantees the address can be used without injection risk within the sending engine.

Required dependencies: egulias/email-validator ^2.0 and symfony/validator, both already in the composer.json of 1.7.8.

Same structure as 1.7.8, but with an important change: Symfony's validator strict mode is activated, which applies the complete RFC 5322 grammar instead of the usual subset. This rejects variants such as addresses with comments (user(comment)@example.com) or with IP literals (user@[192.0.2.1]) that are syntactically valid according to the RFC but inappropriate in an e-commerce context. The redundant !empty($email) check in the return is also eliminated, as the guard at the beginning of the method makes it unnecessary.

AFTER (Validate-8_1.php patched):

public static function isEmail($email)
{
    if (empty($email)) {
        return false;
    }
    $validator = Validation::createValidator();
    $errors = $validator->validate($email, new Email([
        'mode' => 'strict', // ← new compared to 1.7.8
    ]));
    if (count($errors) > 0) {
        return false;
    }
    // Check if the value is correct according to both validators (RFC & SwiftMailer)
    return (new EmailValidator())->isValid($email, new MultipleValidationWithAnd([
        new RFCValidation(),
        new SwiftMailerValidation(),
    ]));
}

Required dependencies: egulias/email-validator ^3.0 (the 8.x branch upgraded the major version compared to 1.7.8) and symfony/validator ^5.4.

If your store runs 8.2.5 or PrestaShop 9.1.0, simply update to the latest available version of your branch (8.2.6 and 9.1.1 respectively) to keep your store secure.