fix: enforce default blocked email domains list on a stock install

.changeset/fix-default-blocked-email-domains.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the default blocked email domains list (`Accounts_UseDefaultBlockedDomainsList`) being ignored during registration unless a custom `Accounts_BlockedDomainsList` was also set. The two settings are now independent, so the built-in list of disposable/throwaway domains is enforced on a stock install as intended.

apps/meteor/jest.config.ts

@@ -51,6 +51,7 @@ export default {
 				'<rootDir>/server/api/v1/middlewares/*.spec.ts',
 				'<rootDir>/server/lib/cloud/version-check/**/*.spec.ts',
 				'<rootDir>/server/lib/auth-providers/apple/**.spec.ts',
+				'<rootDir>/server/lib/isEmailDomainBlocked.spec.ts',
 			],
 			coveragePathIgnorePatterns: ['/node_modules/'],
 		},

apps/meteor/server/lib/isEmailDomainBlocked.spec.ts

@@ -0,0 +1,22 @@
+import { isEmailDomainBlocked } from './isEmailDomainBlocked';
+
+// `0-mail.com` is present in the built-in default list; `gmail.com` is not.
+describe('isEmailDomainBlocked', () => {
+	it('blocks a default-listed domain when the default list is enabled, even with an empty custom list', () => {
+		// Regression: previously the default list was only consulted when the
+		// custom list was non-empty, so on a stock install this returned false.
+		expect(isEmailDomainBlocked('0-mail.com', [], true)).toBe(true);
+	});
+
+	it('does not block a default-listed domain when the default list is disabled', () => {
+		expect(isEmailDomainBlocked('0-mail.com', [], false)).toBe(false);
+	});
+
+	it('blocks a domain on the custom list', () => {
+		expect(isEmailDomainBlocked('evil.example', ['evil.example'], false)).toBe(true);
+	});
+
+	it('does not block a domain that is on neither list', () => {
+		expect(isEmailDomainBlocked('gmail.com', ['evil.example'], true)).toBe(false);
+	});
+});

apps/meteor/server/lib/isEmailDomainBlocked.ts

@@ -0,0 +1,14 @@
+import { emailDomainDefaultBlackList } from './defaultBlockedDomainsList';
+
+/**
+ * Decide whether an email domain should be blocked at registration.
+ *
+ * The admin-configured blocklist (`Accounts_BlockedDomainsList`) and the
+ * built-in default list (`Accounts_UseDefaultBlockedDomainsList`) are
+ * independent controls, so the default list must apply on its own even when no
+ * custom domain has been configured. Previously both checks were gated behind
+ * the custom list being non-empty, so on a stock install the default list was
+ * never consulted.
+ */
+export const isEmailDomainBlocked = (emailDomain: string, blockList: string[], useDefaultList: boolean): boolean =>
+	(blockList.length > 0 && blockList.includes(emailDomain)) || (useDefaultList && emailDomainDefaultBlackList.includes(emailDomain));

apps/meteor/server/lib/validateEmailDomain.js

@@ -4,7 +4,7 @@ import util from 'node:util';
 import { validateEmail } from '@rocket.chat/tools';
 import { Meteor } from 'meteor/meteor';
 
-import { emailDomainDefaultBlackList } from './defaultBlockedDomainsList';
+import { isEmailDomainBlocked } from './isEmailDomainBlocked';
 import { settings } from '../settings';
 
 const dnsResolveMx = util.promisify(dns.resolveMx);
@@ -50,11 +50,7 @@ export const validateEmailDomain = async function (email) {
 			function: 'RocketChat.validateEmailDomain',
 		});
 	}
-	if (
-		emailDomainBlackList.length &&
-		(emailDomainBlackList.indexOf(emailDomain) !== -1 ||
-			(settings.get('Accounts_UseDefaultBlockedDomainsList') && emailDomainDefaultBlackList.indexOf(emailDomain) !== -1))
-	) {
+	if (isEmailDomainBlocked(emailDomain, emailDomainBlackList, settings.get('Accounts_UseDefaultBlockedDomainsList'))) {
 		throw new Meteor.Error('error-email-domain-blacklisted', 'The email domain is blacklisted', {
 			function: 'RocketChat.validateEmailDomain',
 		});