From 756afd0fa7deff15c1e6ef0e222a54389c485011 Mon Sep 17 00:00:00 2001
From: Tomas Strba <tom@duckduckgo.com>
Date: Tue, 15 Oct 2024 10:53:04 +0200
Subject: [PATCH] Email parsing improved

---
 Sources/Common/Extensions/URLExtension.swift  | 22 ++++++++++++++++++-
 .../Extensions/URLExtensionTests.swift        |  8 +++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/Sources/Common/Extensions/URLExtension.swift b/Sources/Common/Extensions/URLExtension.swift
index 5b5871221..73eea7328 100644
--- a/Sources/Common/Extensions/URLExtension.swift
+++ b/Sources/Common/Extensions/URLExtension.swift
@@ -176,7 +176,23 @@ extension URL {
                urlWithScheme.port != nil || urlWithScheme.user != nil {
                 // could be a local domain but user needs to use the protocol to specify that
                 // make exception for "localhost"
-                guard urlWithScheme.host?.contains(".") == true || urlWithScheme.host == .localhost else { return nil }
+                let hasDomain = urlWithScheme.host?.contains(".") == true
+                guard hasDomain || urlWithScheme.host == .localhost else { return nil }
+
+                let isInvalidUserInfo = {
+                    let hasUser = urlWithScheme.user != nil
+                    let hasPassword = urlWithScheme.password != nil
+                    let hasPath = !urlWithScheme.path.isEmpty
+                    let hasPort = urlWithScheme.port != nil
+                    let hasFragment = urlWithScheme.fragment != nil
+
+                    return hasUser && !hasPassword && !hasPath && !hasPort && !hasFragment
+                }()
+
+                if isInvalidUserInfo {
+                    return nil
+                }
+
                 self = urlWithScheme
                 return
 
@@ -223,6 +239,10 @@ extension URL {
 
         guard let (authData, urlPart, query) = Self.fixupAndSplitURLString(s) else { return nil }
 
+        if (authData?.contains(" ") == true) || urlPart.contains(" ") {
+            return nil
+        }
+
         let componentsWithoutQuery = urlPart.split(separator: "/").map(String.init)
         guard !componentsWithoutQuery.isEmpty else {
             return nil
diff --git a/Tests/CommonTests/Extensions/URLExtensionTests.swift b/Tests/CommonTests/Extensions/URLExtensionTests.swift
index 2172e4c75..fceef4ed3 100644
--- a/Tests/CommonTests/Extensions/URLExtensionTests.swift
+++ b/Tests/CommonTests/Extensions/URLExtensionTests.swift
@@ -551,6 +551,14 @@ final class URLExtensionTests: XCTestCase {
         XCTAssertEqual(result.last, .init(name: "another_item", value: "test_2"))
     }
 
+    func testWhenUserInfoDoesNotContaintPassword_ThenNavigateToSearch() {
+        XCTAssertNil(URL(trimmedAddressBarString: "user@domain.com"))
+        XCTAssertNil(URL(trimmedAddressBarString: "user: @domain.com"))
+
+        XCTAssertEqual(URL(trimmedAddressBarString: "user:,,@domain.com")?.host, "domain.com")
+        XCTAssertEqual(URL(trimmedAddressBarString: "user:pass@domain.com")?.host, "domain.com")
+    }
+
 }
 
 extension String {