cama_contact_form 0.1.0 → 0.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8f3c768c126ee5bc5444636a26f1aa0423bf74f7e6851ce8d0c656330a137ea
-  data.tar.gz: c52eea668803c03487b09a4a5af1a21c17b30f18339f899dc5cad06cab79909b
+  metadata.gz: 0773dea2d0ad03b4c0179fc634372ab5fe9a6111da16fe0c187118475df052f6
+  data.tar.gz: 7868caf0afb73a4f508855521a1c4a15660a7786dbea9876303096402f198844
 SHA512:
-  metadata.gz: 6dcf81c9421fc18ea88be664ba52d3f5471eeb59fc0aeeb7c1f942a4e7e4eaddfa2823c55d236373c2f0ff206b038116ceb907d52b392f2bfe64d8b66ea37143
-  data.tar.gz: faca0df162e1a7ca43824b172b41c26ce9b5d86c83b83d75bc5ffa74f925e0fc985705edb46f655bd6a623fe7854567869e5b729a0f54331514eba24b9de974c
+  metadata.gz: 9435100f0afd723a911aa6efee2fc5ed30610b7eea1a5f640eeb45d6e5ff92a7199d4360d599b0ebffcfc279e79fb17dff80135fb4db69e9d88233d356001ea8
+  data.tar.gz: 563ba96b2539b554971caee757e47ed840ac48918c7564993197095876d3435b74ac86974023caead09ebcb6742f979f86d1ab58e651d87f7b47e134a5036c66

data/README.md

@@ -0,0 +1,203 @@
+# Camaleon CMS Plugin
+This is a plugin for Camaleon CMS to manage Contact Forms
+
+## Releasing
+
+Releases are cut by the **Release** GitHub Actions workflow
+([`.github/workflows/release_builder.yml`](.github/workflows/release_builder.yml)). It only runs
+when you start it by hand — merging to `master` releases nothing. A single run does everything a
+release needs, in this order:
+
+1. verifies the release is safe to cut (see [What the workflow checks](#what-the-workflow-checks)),
+2. builds the gem and inspects the built artifact,
+3. pushes it to RubyGems,
+4. creates the annotated git tag,
+5. publishes the GitHub release, with notes taken from `CHANGELOG.md` and the `.gem` plus its
+   checksums attached.
+
+No tests run here — the release workflow only builds and publishes the gem.
+
+`lib/cama_contact_form/version.rb` is the single source of truth for the version. The tag, the
+published gem and the GitHub release all derive from it, so they cannot disagree.
+
+> **`0.1.12` below is only an example.** Every command, filename and heading in this section uses it
+> as a stand-in for the version you are actually releasing — substitute yours as you go. This
+> document is not updated each release, so do not expect the number here to be the next one.
+
+### Before you start
+
+- You need **write access** to this repository.
+- The `RUBY_GEMS_PUBLISH_GEM_KEY` repository secret must exist — it is the RubyGems API key the
+  workflow publishes with. It is already configured; you never need to see or handle its value.
+- You do **not** need RubyGems credentials on your own machine for the automated release. You only
+  need them for the [manual fallback](#fallback-releasing-entirely-by-hand).
+
+### Step 1 — Open a release PR
+
+Create a branch, bump the version, and describe the release:
+
+```bash
+git checkout master && git pull
+git checkout -b release/0.1.12
+```
+
+Edit `lib/cama_contact_form/version.rb`:
+
+```ruby
+module CamaContactForm
+  VERSION = '0.1.12'
+end
+```
+
+Then add a matching section at the top of `CHANGELOG.md`, directly under the `# Change Log`
+heading. If an `## Unreleased` section is already sitting there, rename it to the version you are
+shipping and fold your notes into it rather than adding a second section.
+
+**The heading must be exactly `## 0.1.12`** — the workflow copies everything between that heading
+and the next `## ` into the GitHub release body, so an inexact heading (`## v0.1.12`,
+`## 0.1.12 (2026-08-01)`, or a leftover `## Unreleased`) silently costs you your release notes and
+falls back to a bare commit list:
+
+```markdown
+## 0.1.12
+
+What changed and why it matters to someone upgrading.
+[#65](https://github.com/owen2345/cama_contact_form/pull/65)
+```
+
+Commit, push, open the PR, and merge it once it is approved:
+
+```bash
+git commit -am "Release 0.1.12"
+git push -u origin release/0.1.12
+gh pr create --title "Release 0.1.12" --body "Bumps the version and adds the changelog entry."
+```
+
+### Step 2 — Run the Release workflow
+
+Merging does **not** publish anything. Once the PR is merged:
+
+1. Open the repository on GitHub.
+2. Click the **Actions** tab (in the top row, next to *Pull requests*).
+3. In the left sidebar, under *All workflows*, click **Release**.
+4. On the right-hand side of the blue banner, click the **Run workflow** dropdown button.
+5. Leave **Use workflow from** as `Branch: master`. The workflow refuses to run from any other
+   branch, so a gem can never be published from unmerged code.
+6. In **Version to release**, type the version exactly as it appears in `version.rb` — not the
+   `0.1.12` of this example. A leading `v` is accepted and stripped, and a mismatch fails the run
+   before anything is published.
+7. Click the green **Run workflow** button.
+
+The page takes a few seconds to show the new run; reload if it does not appear. Click into the run
+to watch the three jobs — *Verify and build*, *Publish to RubyGems*, and *Tag and publish GitHub
+release* — go green in turn.
+
+> If the **Release** workflow is not listed in step 3, the workflow file has not reached `master`
+> yet. GitHub only offers a manually-triggered workflow once its file exists on the default branch.
+> Merge the PR first.
+
+### Step 3 — Confirm
+
+- **RubyGems**: <https://rubygems.org/gems/cama_contact_form/versions/0.1.12> — it can take a
+  minute or two to appear.
+- **GitHub**: the repository's *Releases* page should show *Release 0.1.12* with your changelog
+  text and three attached files (`.gem`, `.sha256`, `.sha512`).
+- Locally: `gem fetch cama_contact_form -v 0.1.12`
+
+### What the workflow checks
+
+Every check runs *before* anything is published, because pushing to RubyGems is the only step that
+cannot be undone — a version can be yanked, but that version number can never be re-used. If a
+check fails, nothing has been published and nothing has been tagged: fix the cause and start the
+workflow again.
+
+| Failure message | Cause | Fix |
+| --- | --- | --- |
+| `is not a valid gem version` | Typo in the input box | Re-run with the correct version |
+| `Releases must be cut from master` | *Use workflow from* was not `master` | Re-run from `master` |
+| `does not match lib/cama_contact_form/version.rb` | The typed version and `version.rb` disagree | Bump `version.rb`, or type the version it already has |
+| `Tag <version> already exists` | That version was released before | Bump to a new version |
+| `already published on RubyGems` | Same, but caught on the RubyGems side | Bump to a new version |
+| `No release notes` | No `## <version>` section in `CHANGELOG.md` **and** no commits since the last tag | Add the changelog section |
+| `gem build` fails under `--strict` | The gemspec has a warning (missing homepage, missing `required_ruby_version`, …) | Fix the gemspec |
+| `Test files packaged into the gem` | `s.test_files` was re-added to the gemspec | Remove it — RubyGems merges `test_files` into `files` |
+| `<file> is missing from the gem` | A filename in `s.files` no longer matches a real file | Correct the name in the gemspec |
+
+The one failure that needs manual recovery is a job that fails *after* `gem push` succeeded — the
+gem is public, but the tag and release were never created. Do not re-run the workflow, it would
+stop at the "already published" check. Finish it by hand instead, using steps 5 and 6 of the
+fallback below.
+
+### Fallback: releasing entirely by hand
+
+Use this if Actions is down, if the workflow is broken, or to finish a release that failed after
+the gem was already pushed. It needs your own RubyGems credentials, and you must be an owner of the
+gem on RubyGems.
+
+As above, **`0.1.12` is a stand-in for the version you are releasing** — every command below needs
+your own number substituted in, including the `.gem` filenames.
+
+Sign in to RubyGems once per machine — this writes a token to `~/.gem/credentials`:
+
+```bash
+gem signin
+```
+
+Then, from a clean checkout of `master` with the correct version already in `version.rb`:
+
+**1. Start from exactly what you intend to publish.**
+
+```bash
+git checkout master && git pull && git status
+```
+
+`git status` must report a clean tree — `gem build` packages the files on disk, so any stray local
+edit would end up in the published gem.
+
+**2. Build the gem.**
+
+```bash
+gem build cama_contact_form.gemspec --strict
+```
+
+**3. Inspect what you are about to publish.** This is the step the workflow automates; publishing
+is irreversible, so it is worth the minute.
+
+```bash
+gem unpack cama_contact_form-0.1.12.gem --target /tmp/gem-check
+find /tmp/gem-check -type f | sort
+```
+
+Expect about 26 files in total: `MIT-LICENSE`, `Rakefile`, `README.md`, and the rest under `app/`,
+`config/`, `db/` and `lib/`. There must be **no `test/` directory** and no credentials of any kind.
+
+**4. Push to RubyGems.** If your account has MFA enabled for publishing, this prompts for a
+one-time code.
+
+```bash
+gem push cama_contact_form-0.1.12.gem
+```
+
+**5. Create and push the tag.** Annotated (`-a`), to match every existing tag in this repository:
+
+```bash
+git tag -a 0.1.12 -m "Release 0.1.12"
+git push origin 0.1.12
+```
+
+**6. Publish the GitHub release.** Either with the CLI:
+
+```bash
+gh release create 0.1.12 --title "Release 0.1.12" --notes-file notes.md cama_contact_form-0.1.12.gem
+```
+
+where `notes.md` holds the changelog section for this version — or through the web interface:
+
+1. On the repository's front page, click **Releases** in the right-hand sidebar.
+2. Click **Draft a new release**.
+3. In **Choose a tag**, select the `0.1.12` tag you pushed in step 5.
+4. Set **Target** to `master`.
+5. Set the title to `Release 0.1.12`.
+6. Paste the `CHANGELOG.md` section for this version into the description box.
+7. Drag `cama_contact_form-0.1.12.gem` into the *Attach binaries* area at the bottom.
+8. Click **Publish release**.

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 begin
   require 'bundler/setup'
 rescue LoadError
@@ -10,28 +12,11 @@ RDoc::Task.new(:rdoc) do |rdoc|
   rdoc.rdoc_dir = 'rdoc'
   rdoc.title    = 'CamaContactForm'
   rdoc.options << '--line-numbers'
-  rdoc.rdoc_files.include('README.rdoc')
+  rdoc.rdoc_files.include('README.md')
   rdoc.rdoc_files.include('lib/**/*.rb')
 end
 
-APP_RAKEFILE = File.expand_path("../test/dummy/Rakefile", __FILE__)
-load 'rails/tasks/engine.rake'
-
-
-load 'rails/tasks/statistics.rake'
-
-
-
+# The plugin's behaviour is exercised host-side in the camaleon_cms repository (see README /
+# CHANGELOG); this repo ships no test suite, so the dummy-app engine tasks and the default `test`
+# task are intentionally absent. `Bundler::GemHelper.install_tasks` still provides build/install/release.
 Bundler::GemHelper.install_tasks
-
-require 'rake/testtask'
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << 'lib'
-  t.libs << 'test'
-  t.pattern = 'test/**/*_test.rb'
-  t.verbose = false
-end
-
-
-task default: :test

data/app/assets/javascripts/plugins/cama_contact_form/admin_editor.js

@@ -16,7 +16,7 @@ $(function() {
         res.find('.options_sortable').sortable({ handle: '.options-sortable' })
         res.find('.add_option').click().click()
         res.find('.translatable').Translatable(ADMIN_TRANSLATIONS)
-        return hideLoading()
+        hideLoading()
       })
     return false
   })
@@ -27,7 +27,7 @@ $(function() {
 
     const clone = list.children().first().clone().removeClass('hidden')
     clone.find('input').prop('disabled', false).each(function() {
-      return $(this).attr('name', $(this).attr('name').replace('[0]', '[' + list.attr('data-options-count') + ']'))
+      $(this).attr('name', $(this).attr('name').replace('[0]', '[' + list.attr('data-options-count') + ']'))
     })
 
     list.append(clone)
@@ -42,7 +42,7 @@ $(function() {
 
   panel.on('click', '.panel-delete', function() {
     $(this).closest('li.panel').fadeOut('slow', function() {
-      return $(this).remove()
+      $(this).remove()
     })
     return false
   })
@@ -53,5 +53,5 @@ $(function() {
   })
 
   myFields.find('.options_sortable').sortable({ handle: '.options-sortable' })
-  return panel.find('.translatable').Translatable(ADMIN_TRANSLATIONS)
+  panel.find('.translatable').Translatable(ADMIN_TRANSLATIONS)
 })

data/app/controllers/concerns/plugins/cama_contact_form/contact_form_controller_concern.rb

@@ -1,76 +1,250 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+# Contact-form logic shared by the admin and front controllers: it gates authored markup at save
+# time, and validates, stores and mails a visitor's submission.
 module Plugins::CamaContactForm::ContactFormControllerConcern
+  # The field types whose submitted value the renderer interpolates back into the page, and the
+  # position each one lands in. Everything else -- radio, checkboxes, dropdown, file -- is only ever
+  # compared against, never interpolated, so nothing it contains can escape anything.
+  ECHOED_ATTRIBUTE_FIELD_TYPES = %w[text website email].freeze
+  ECHOED_TEXTAREA_FIELD_TYPES = %w[paragraph textarea].freeze
+
+  # Field types whose submitted value is a list of chosen option labels, joined for the mail summary.
+  MULTI_VALUE_FIELD_TYPES = %w[radio checkboxes].freeze
+
+  # Elements that do something rather than say something, wherever they appear.
+  ACTIVE_ELEMENTS = %w[script style iframe object embed applet frame frameset form input button
+                       link meta base svg math template].freeze
+  ACTIVE_ELEMENT = %r{<\s*/?\s*(?:#{ACTIVE_ELEMENTS.join('|')})\b}i
+  EVENT_HANDLER_IN_TAG = /<[a-zA-Z][^>]*\son[a-zA-Z]+\s*=/im
+  URL_SCHEME_IN_TAG =
+    /<[a-zA-Z][^>]*\b(?:href|src|action|formaction|data|poster|srcdoc|background)\s*=\s*
+       ["']?\s*(?:javascript|vbscript|data)\s*:/imx
+
   def perform_save_form(form, fields, success, errors)
     attachments = []
-    if validate_to_save_form(form, fields, errors)
-      form.fields.each do |f|
-        if f[:field_type] == 'file'
-          file_paths = []
-          fields[f[:cid].to_sym].to_a.each do |file|
-            res = cama_tmp_upload(file, {
-                maximum: current_site.get_option('filesystem_max_size', 100).megabytes,
-                path: Rails.public_path.join("contact_form", current_site.id.to_s),
-                name: file.original_filename
-              }
-            )
-            if res[:error].present?
-              errors << res[:error].to_s.translate
-            else
-              attachments << res[:file_path]
-              file_paths << res[:file_path].sub(Rails.public_path.to_s, cama_root_url)
-            end
-          end
-          fields[f[:cid].to_sym] = file_paths
+    return unless validate_to_save_form(form, fields, errors)
+
+    form.fields.each do |f|
+      next unless f[:field_type] == 'file'
+
+      file_paths = []
+      fields[f[:cid].to_sym].to_a.each do |file|
+        res = cama_tmp_upload(file, {
+                                maximum: current_site.get_option('filesystem_max_size', 100).megabytes,
+                                path: Rails.public_path.join('contact_form', current_site.id.to_s),
+                                name: file.original_filename
+                              })
+        if res[:error].present?
+          errors << res[:error].to_s.translate
+        else
+          attachments << res[:file_path]
+          file_paths << res[:file_path].sub(Rails.public_path.to_s, cama_root_url)
         end
       end
-      new_settings = {"fields" => fields, "created_at" => Time.current.strftime("%Y-%m-%d %H:%M:%S").to_s}.to_json
-      form_new = current_site.contact_forms.new(name: "response-#{Time.now}", description: form.description, settings: new_settings, site_id: form.site_id, parent_id: form.id)
-      if form_new.save
-        fields_data = convert_form_values(form, fields)
-        message_body = form.the_settings[:railscf_mail][:body].to_s.translate.cama_replace_codes(fields)
-        content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: ['html'], locals: {file_attachments: attachments, fields: fields_data, values: fields, message_body: message_body, form: form})
-        cama_send_email(form.the_settings[:railscf_mail][:to], form.the_settings[:railscf_mail][:subject].to_s.translate.cama_replace_codes(fields), {attachments: attachments, content: content, extra_data: {fields: fields_data}})
-        success << form.the_message('mail_sent_ok', t('.success_form_val', default: 'Your message has been sent successfully. Thank you very much!'))
-        args = {form: form, values: fields}; hooks_run("contact_form_after_submit", args)
-        if form.the_settings[:railscf_mail][:to_answer].present? && (answer_to = fields[form.the_settings[:railscf_mail][:to_answer].gsub(/(\[|\])/, '').to_sym]).present?
-          content = form.the_settings[:railscf_mail][:body_answer].to_s.translate.cama_replace_codes(fields)
-          cama_send_email(answer_to, form.the_settings[:railscf_mail][:subject_answer].to_s.translate.cama_replace_codes(fields), {content: content})
-        end
-      else
-        errors << form.the_message('mail_sent_ng', t('.error_form_val', default: 'An error occurred, please try again.'))
+      fields[f[:cid].to_sym] = file_paths
+    end
+    new_settings = { 'fields' => fields, 'created_at' => Time.now.utc.strftime('%Y-%m-%d %H:%M:%S').to_s }.to_json
+    form_new = current_site.contact_forms.new(name: "response-#{Time.now.utc}", description: form.description,
+                                              settings: new_settings, site_id: form.site_id, parent_id: form.id)
+    if form_new.save
+      fields_data = convert_form_values(form, fields)
+      message_body = form.mail_settings[:body].to_s.translate.cama_replace_codes(fields)
+      content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: [:html],
+                                 locals: { file_attachments: attachments, fields: fields_data, values: fields,
+                                           message_body: message_body, form: form })
+      cama_send_email(form.mail_settings[:to],
+                      form.mail_settings[:subject].to_s.translate.cama_replace_codes(fields),
+                      { attachments: attachments, content: content, extra_data: { fields: fields_data } })
+      success << form.the_message('mail_sent_ok',
+                                  t('.success_form_val',
+                                    default: 'Your message has been sent successfully. Thank you very much!'))
+      args = { form: form, values: fields }
+      hooks_run('contact_form_after_submit', args)
+      if (answer_to = auto_reply_recipient(form, fields))
+        content = form.mail_settings[:body_answer].to_s.translate.cama_replace_codes(fields)
+        cama_send_email(answer_to, form.mail_settings[:subject_answer].to_s.translate.cama_replace_codes(fields),
+                        { content: content })
       end
+    else
+      errors << form.the_message('mail_sent_ng',
+                                 t('.error_form_val', default: 'An error occurred, please try again.'))
+    end
+  end
+
+  # CF-1: the auto-reply ("confirmation e-mail") recipient is whatever the visitor typed into the field
+  # named by `to_answer`, so it is fully attacker-controlled -- unchecked, the feature sends mail from
+  # the site's own From address to anyone. The reply goes to the normalized address, or nowhere.
+  # Volume across submissions is a separate concern (CF-2, rate limiting).
+  #
+  # A refused present value is logged -- otherwise the response is indistinguishable from full
+  # success and a lost confirmation is undiagnosable. The line names the form, not the value: the
+  # value is hostile by hypothesis, and hostile bytes don't belong in the log stream. An absent or
+  # blank value stays silent, as it always has -- the visitor supplied nothing to refuse.
+  def auto_reply_recipient(form, fields)
+    return if form.mail_settings[:to_answer].blank?
+
+    value = fields[form.mail_settings[:to_answer].to_s.gsub(/(\[|\])/, '').to_sym]
+    address = normalized_email_address(value)
+    if address.nil? && value.present?
+      Rails.logger.warn("cama_contact_form: auto-reply for form #{form.id} skipped, recipient failed validation (CF-1)")
+    end
+    address
+  end
+
+  # The stripped value when it is a single, syntactically-valid address; nil otherwise. Surrounding
+  # whitespace is stripped -- a pasted or mobile-typed address often carries a stray space, and the
+  # mailer delivered those before this guard existed -- and what remains must match
+  # `URI::MailTo::EMAIL_REGEXP`, which is anchored and admits no CR/LF, inner whitespace or `,`/`;`,
+  # so one submission can neither header-inject a Bcc nor fan out to a recipient list. Refused with
+  # the attacks, deliberately: name-addr forms (`Jane <jane@example.com>` -- address lists share that
+  # grammar) and raw-unicode addresses (the regexp is ASCII-only; the punycode form passes). A
+  # non-String value (`fields[cid][]=…` arrives as an Array) is rejected through `to_s` rather than
+  # raising.
+  def normalized_email_address(value)
+    address = value.to_s.strip
+    address if address.match?(URI::MailTo::EMAIL_REGEXP)
+  end
+
+  # A visitor's submission is rejected, not escaped, for the same reason an untrusted author's is:
+  # what is stored and redisplayed then equals what was submitted, so rendering it verbatim adds
+  # nothing.
+  #
+  # Memoized because both the validation and the redisplay decision ask the same question about the
+  # same two objects in a single request, and the walk is over attacker-chosen structure.
+  def unsafe_submitted?(form, fields)
+    return @_cf_unsafe_submitted unless @_cf_unsafe_submitted.nil?
+
+    @_cf_unsafe_submitted = compute_unsafe_submitted?(form, fields)
+  end
+
+  # Fails closed on a missing form: there is nothing to judge the submission against, and the caller
+  # must not go on to stash it.
+  def compute_unsafe_submitted?(form, fields)
+    return true if form.blank?
+    return true unless fields.is_a?(Hash) || fields.is_a?(ActionController::Parameters)
+
+    form.fields.any? { |f| unsafe_submitted_field?(f, fields[f[:cid].to_sym]) }
+  end
+
+  # Two sinks, judged separately because they are different contexts:
+  #
+  #   The notification e-mail interpolates every submitted value into an author-written body and
+  #   renders the result with `raw`, so a value carrying active markup is refused whatever its type.
+  #   The test is deliberately narrow -- script, an event handler, a script URL -- and not a
+  #   sanitizer, which would reject ordinary prose: a visitor writing `Fish & Chips <today>` would be
+  #   told their message is not allowed, which is both wrong and infuriating.
+  #
+  #   The redisplayed form interpolates the value only for the types listed above, and only into a
+  #   double-quoted value attribute or into `<textarea>` content. A paragraph is RCDATA, where markup
+  #   is literal text and only the closing tag ends it, so quotes and angle brackets are ordinary
+  #   characters there.
+  def unsafe_submitted_field?(field, value)
+    return false if value.blank?
+    return true if submitted_leaves(value).any? { |leaf| active_markup?(leaf) }
+
+    type = field[:field_type].to_s
+    if ECHOED_TEXTAREA_FIELD_TYPES.include?(type)
+      echoed_value(value).downcase.include?('</textarea')
+    elsif ECHOED_ATTRIBUTE_FIELD_TYPES.include?(type)
+      echoed_value(value).include?('"')
+    else
+      false
     end
   end
 
+  # The exact string the renderer will emit. `values[cid]` is interpolated directly, so a non-String
+  # is judged by its `to_s` -- which is how an Array or a Hash supplies the double quote that closes
+  # the attribute without the payload needing one of its own. Judging the leaves instead of the whole
+  # missed that; judging `Array#to_s` for *every* type refused every checkbox and every file upload,
+  # because `Array#to_s` is `inspect` and always carries quotes.
+  def echoed_value(value)
+    value.is_a?(String) ? value : value.to_s
+  end
+
+  # An uploaded file is not redisplayed and has no string form worth inspecting; everything else is
+  # judged as the mail body will interpolate it.
+  def submitted_leaves(value)
+    case value
+    when ActionController::Parameters then submitted_leaves(value.to_unsafe_h)
+    when Hash then value.values.flat_map { |v| submitted_leaves(v) }
+    when Array then value.flat_map { |v| submitted_leaves(v) }
+    when ActionDispatch::Http::UploadedFile then []
+    else [value.to_s]
+    end
+  end
+
+  def active_markup?(string)
+    string = string.to_s
+    return false unless string.include?('<')
+
+    string.match?(ACTIVE_ELEMENT) || string.match?(EVENT_HANDLER_IN_TAG) || string.match?(URL_SCHEME_IN_TAG)
+  end
+
   # form validations
   def validate_to_save_form(form, fields, errors)
+    # Refuse outright and stop, before any other validation runs.
+    #
+    # Nothing is stored either way, so there is nothing to gain by continuing -- and continuing means
+    # running the rest of this method over input already known to be hostile, including a reCAPTCHA
+    # round-trip to an external service.
+    #
+    # The message names no field and quotes nothing back. The frontend flash partial renders with
+    # `raw`, so echoing the refused value there would make the refusal itself an injection sink --
+    # the same trap as the admin path.
+    if form.blank? || !(fields.is_a?(Hash) || fields.is_a?(ActionController::Parameters))
+      errors << t('.invalid_request_val', default: 'That form could not be submitted. Please try again.')
+      return false
+    end
+
+    if unsafe_submitted?(form, fields)
+      errors << form.the_message('invalid_content',
+                                 t('.invalid_content_val',
+                                   default: 'Your message contains characters that are not allowed. ' \
+                                            'Please remove any HTML or quotation marks and try again.'))
+      return false
+    end
+
     validate = true
+
     form.fields.each do |f|
       cid = f[:cid].to_sym
       label = f[:label].to_sym
       case f[:field_type].to_s
-        when 'text', 'website', 'paragraph', 'textarea', 'email', 'radio', 'checkboxes', 'dropdown', 'file'
-          if f[:required].to_s.cama_true? && !fields[cid].present?
-            errors << "#{label.to_s.translate}: #{form.the_message('invalid_required', t('.error_validation_val', default: 'This value is required'))}"
-            validate = false
-          end
-          if f[:field_type].to_s == 'email'
-            unless fields[cid].match(/@/)
-              errors << "#{label.to_s.translate}: #{form.the_message('invalid_email', t('.email_invalid_val', default: 'The e-mail address appears invalid'))}"
-              validate = false
-            end
-          end
-        when 'captcha'
-          error_message = ->{
-            errors << "#{label.to_s.translate}: #{form.the_message('captcha_not_match', t('.captch_error_val', default: 'The entered code is incorrect'))}"
-            validate = false
-          }
-
-          if form.recaptcha_enabled?
-            form.set_captcha_settings!
-            error_message.call unless verify_recaptcha
-          else
-            error_message.call unless cama_captcha_verified?
-          end
+      when 'text', 'website', 'paragraph', 'textarea', 'email', 'radio', 'checkboxes', 'dropdown', 'file'
+        if f[:required].to_s.cama_true? && fields[cid].blank?
+          errors << "#{label.to_s.translate}: #{form.the_message('invalid_required',
+                                                                 t('.error_validation_val',
+                                                                   default: 'This value is required'))}"
+          validate = false
+        end
+        # Judged by the same rule as the auto-reply recipient (`normalized_email_address`, which is
+        # total on any submitted shape -- the submitter chooses whether to send the key at all, and
+        # in what shape), so the field validation and the send decision cannot disagree: a malformed
+        # address is an error the visitor can act on here, not a success message followed by a
+        # confirmation that silently never arrives.
+        if (f[:field_type].to_s == 'email') && normalized_email_address(fields[cid]).nil?
+          errors << "#{label.to_s.translate}: #{form.the_message('invalid_email',
+                                                                 t('.email_invalid_val',
+                                                                   default: 'The e-mail address appears invalid'))}"
+          validate = false
+        end
+      when 'captcha'
+        error_message = lambda {
+          errors << "#{label.to_s.translate}: #{form.the_message('captcha_not_match',
+                                                                 t('.captch_error_val',
+                                                                   default: 'The entered code is incorrect'))}"
+          validate = false
+        }
+
+        if form.recaptcha_enabled?
+          form.set_captcha_settings!
+          error_message.call unless verify_recaptcha
+        else
+          error_message.call unless cama_captcha_verified?
+        end
       end
     end
     validate
@@ -81,23 +255,24 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     values = {}
     form.fields.each do |field|
       next unless relevant_field?(field)
+
       ft = field[:field_type]
       cid = field[:cid].to_sym
-      label = values.keys.include?(field[:label]) ? "#{field[:label]} (#{cid})" : field[:label].to_s.translate
+      label = values.key?(field[:label]) ? "#{field[:label]} (#{cid})" : field[:label].to_s.translate
       values[label] = []
       if ft == 'file'
-        nr_files = fields[cid].size
-        values[label] << "#{nr_files} #{"file".pluralize(nr_files)} (attached)" if fields[cid].present?
-      elsif ft == 'radio' || ft == 'checkboxes'
-        values[label] << fields[cid].map { |f| f.to_s.translate }.join(', ') if fields[cid].present?
-      else
-        values[label] << fields[cid] if fields[cid].present?
+        nr_files = Array(fields[cid]).size
+        values[label] << "#{nr_files} #{'file'.pluralize(nr_files)} (attached)" if fields[cid].present?
+      elsif MULTI_VALUE_FIELD_TYPES.include?(ft)
+        values[label] << Array(fields[cid]).map { |f| f.to_s.translate }.join(', ') if fields[cid].present?
+      elsif fields[cid].present?
+        values[label] << fields[cid]
       end
     end
     values
   end
 
   def relevant_field?(field)
-    !%w(captcha submit button).include? field[:field_type]
+    %w[captcha submit button].exclude?(field[:field_type])
   end
 end