fix(landing): reject injection-scanner emails at the contact-sales boundary (#5863)

07-11 an SQLi scanner submitted ~19 payload emails like
testing@example.com'||dbms_pipe.receive_message(...)||' to /contact-sales.
The loose EMAIL_RE (no whitespace, one @, a dot) accepted them into the
CONTACT_LEADS KV namespace, and the downstream Bitable leads sync — whose
email column rejects such values inside an atomic batch insert — failed on
every run for six days, silently stalling 30+ real leads.

Tighten EMAIL_RE: dotted alphanumeric domain labels with a letters-only
TLD; local part keeps the common atom charset including apostrophes
(o'brien@…). Red spec first: the new test replays the captured scanner
payloads (red on the old regex) and pins real-lead shapes as passing.

Co-authored-by: NJUHua <113895241+NJUHua@users.noreply.github.com>

Author: open-design-crew[bot]

apps/landing-page/functions/contact-sales.ts

@@ -67,7 +67,15 @@ const ALLOWED_ORIGINS = [
   "http://127.0.0.1",
 ];
 
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+// Strict shape, not the loose "no whitespace, one @, a dot" check: the 07-11
+// SQLi scan submitted payloads like `testing@example.com'||dbms_pipe...` that
+// the loose regex accepted into KV and which then broke the downstream Bitable
+// sync (its email column rejects them, and the batch insert is atomic).
+// Local part: common atom charset incl. apostrophe (o'brien@…). Domain:
+// hyphenated alphanumeric labels with a letters-only TLD — no quotes, pipes,
+// parens, or `&`/`=` can survive this.
+const EMAIL_RE =
+  /^[A-Za-z0-9._%+'-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*\.[A-Za-z]{2,}$/;
 const MAX_EMAIL_LENGTH = 254;
 const MAX_SHORT = 200;
 const MAX_MESSAGE = 4000;

apps/landing-page/tests/contact-sales.test.ts

@@ -49,6 +49,31 @@ describe("contact-sales validation", () => {
     assert.equal((await call({ name: "Ada", source: "pricing_team" })).body.error, "invalid_email");
   });
 
+  it("rejects injection-scanner emails that are whitespace-free but not a real address (2026-07-11 incident)", async () => {
+    // Real payloads captured from the 07-11 SQLi scan of this endpoint. All
+    // passed the old loose regex (one @, a dot, no whitespace), landed in KV,
+    // and broke the downstream Bitable sync for six days.
+    const payloads = [
+      "testing@example.com'||dbms_pipe.receive_message(chr(98)||chr(98)||chr(98),15)||'",
+      'testing@example.com"&&sleep(27*1000)*nogzzf&&"',
+      "testing@example.com0'xor(if(now()=sysdate(),sleep(15),0))xor'z",
+      "testing@example.com&n964235=v916916",
+      "testing@example.com9408701", // digits-only junk appended to the TLD
+      "../testing@example.com",
+      "testing@example.com'\"",
+    ];
+    for (const email of payloads) {
+      const { status, body } = await call({ ...ENTERPRISE_OK, email });
+      assert.equal(status, 400, `should reject ${email}`);
+      assert.equal(body.error, "invalid_email", `should reject ${email}`);
+    }
+    // Legitimate shapes must keep passing, including an apostrophe local part.
+    assert.equal((await call({ ...ENTERPRISE_OK, email: "o'brien@acme.ie" })).status, 200);
+    assert.equal((await call({ ...ENTERPRISE_OK, email: "w.vince.0202@gmail.com" })).status, 200);
+    assert.equal((await call({ ...ENTERPRISE_OK, email: "bingjunxiang.sd@chinatelecom.cn" })).status, 200);
+    assert.equal((await call({ ...ENTERPRISE_OK, email: "rodrigo@linkflow.com.br" })).status, 200);
+  });
+
   it("does not require a name on the shared lead-form sources; the in-app `client` source still does", async () => {
     // Neither web surface collects a name (email is the contact handle).
     assert.equal((await call(ENTERPRISE_OK)).status, 200);