fix(auth): sanitize email addresses

Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/models/user.js

@@ -143,10 +143,11 @@ module.exports = function (sequelize, DataTypes) {
     return filterXSS(photo)
   }
   User.parseProfileByEmail = function (email) {
+    const sanitizedEmail = email.replaceAll('"', '').replaceAll("'", '').replaceAll('<', '').replaceAll('>', '')
     return {
-      name: email.substring(0, email.lastIndexOf('@')),
-      photo: generateAvatarURL('', email, false),
-      biggerphoto: generateAvatarURL('', email, true)
+      name: sanitizedEmail.split('@')[0],
+      photo: generateAvatarURL('', sanitizedEmail, false),
+      biggerphoto: generateAvatarURL('', sanitizedEmail, true)
     }
   }