• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

MailHelper::cleanAddress() guards against injected headers with preg_match("[\s;,]", $address), but here [ and ] are read as the regex delimiters, so the compiled pattern is the literal sequence \s;, rather than a character class. The guard therefore only fired on an address that contained whitespace immediately followed by ;,, and let a plain space, ;, , or a CR/LF pass through untouched even though the method is documented to return false when injected headers are present. Switched to the intended /[\s;,]/ character class so any address carrying those characters is rejected.

Testing Instructions

Run libraries/vendor/bin/phpunit tests/Unit/Libraries/Cms/Mail/MailHelperTest.php, or call MailHelper::cleanAddress('user@example.com,evil@example.net') directly.

Actual result BEFORE applying this Pull Request

cleanAddress('user@example.com,evil@example.net') returns the address unchanged; values containing a comma, semicolon, whitespace or a newline are accepted instead of rejected.

Expected result AFTER applying this Pull Request

Those inputs return false; only addresses free of whitespace, ;, , and CR/LF are returned.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed