From 92cfd5624dd635778f7da0e9f4144f14fd1000b9 Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Sat, 7 Nov 2026 09:02:18 +0200
Subject: [PATCH] validate email

---
 app/controllers/start_form_controller.rb | 11 ++++++++++-
 app/models/user.rb                       |  4 +++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/app/controllers/start_form_controller.rb b/app/controllers/start_form_controller.rb
index 530b3b7be..74daf0d4b 100644
--- a/app/controllers/start_form_controller.rb
+++ b/app/controllers/start_form_controller.rb
@@ -92,8 +92,11 @@ class StartFormController < ApplicationController
 
     blank_fields = required_fields.select { |key| submitter_params[key].blank? }
 
+    is_invalid_email = required_fields.include?('email') && submitter_params[:email].present? &&
+                       !submitter_params[:email].match?(User::VALIDATE_EMAIL_REGEXP)
+
     submitter =
-      if blank_fields.present?
+      if blank_fields.present? || is_invalid_email
         Submitter.new(submitter_params)
       else
         Submitters::StartForm.find_or_initialize_submitter(
@@ -104,6 +107,12 @@ class StartFormController < ApplicationController
 
     blank_fields.each { |key| submitter.errors.add(key.to_sym, :blank) }
 
+    if is_invalid_email
+      Rollbar.warning("Invalid start form email: #{submitter_params[:email]}") if defined?(Rollbar)
+
+      submitter.errors.add(:email, :invalid)
+    end
+
     submitter
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index b80ae769f..835569e6f 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -56,6 +56,8 @@ class User < ApplicationRecord
   FULL_EMAIL_REGEXP =
     /\A[a-z0-9][.']?(?:(?:[a-z0-9_-]+[.+'])*[a-z0-9_-]+)*@(?:[a-z0-9]+[.-])*[a-z0-9]+\.[a-z]{2,}\z/i
 
+  VALIDATE_EMAIL_REGEXP = /\A[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\z/
+
   has_one_attached :signature
   has_one_attached :initials
 
@@ -78,7 +80,7 @@ class User < ApplicationRecord
   scope :archived, -> { where.not(archived_at: nil) }
   scope :admins, -> { where(role: ADMIN_ROLE) }
 
-  validates :email, format: { with: /\A[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\z/ }
+  validates :email, format: { with: VALIDATE_EMAIL_REGEXP }
 
   def access_token
     super || build_access_token.tap(&:save!)