fix: sonarqube denial of service issue

backend/tests/unit/utils.test.ts

@@ -44,4 +44,31 @@ describe('isValidEmail', () => {
   it('rejects an email with no domain', () => {
     expect(isValidEmail('thom@')).toBe(false);
   });
+
+  it('accepts a multi-label domain', () => {
+    expect(isValidEmail('thom@mail.example.co.uk')).toBe(true);
+  });
+
+  it('rejects a domain with no dot', () => {
+    expect(isValidEmail('thom@localhost')).toBe(false);
+  });
+
+  it('rejects an empty domain label', () => {
+    expect(isValidEmail('thom@example..com')).toBe(false);
+    expect(isValidEmail('thom@.com')).toBe(false);
+  });
+
+  it('rejects more than one @', () => {
+    expect(isValidEmail('thom@foo@example.com')).toBe(false);
+  });
+
+  it('rejects an address longer than 254 characters', () => {
+    expect(isValidEmail(`${'a'.repeat(250)}@example.com`)).toBe(false);
+  });
+
+  it('rejects a long dotless domain without super-linear backtracking', () => {
+    const start = Date.now();
+    expect(isValidEmail(`thom@${'a'.repeat(60_000)}`)).toBe(false);
+    expect(Date.now() - start).toBeLessThan(1000);
+  });
 });