[hoangsvit]

Summary

Fix alias generation so malformed custom tags cannot produce invalid email addresses.

Problem

generateAlias() previously concatenated any non-empty tag directly into the address. Inputs containing whitespace or another @ could therefore produce malformed aliases, for example:

user@gmail.com + shop@example.com
→ user+shop@example.com@gmail.com

Because the shared generator is used by popup, website-aware suggestions, and inline flows, invalid input could propagate across multiple extension surfaces.

Changes

• trim surrounding whitespace from tags;
• reject empty tags;
• reject tags containing whitespace;
• reject tags containing @;
• reject control characters;
• reject base addresses without a routable dotted domain;
• add regression tests for all cases;
• preserve valid existing formats such as private-mail-abc1.

Scope

This is intentionally a focused bug fix and does not touch draft Store-update research in #83/#84.

Tests added

• surrounding tag whitespace is normalized;
• blank tag is rejected;
• internal whitespace is rejected;
• second-domain / @ injection is rejected;
• user@localhost is rejected.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review / merge it when we are online.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ff480a86-a806-4491-9e33-3bbfcf8f30c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in eba34e5...637e148 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Sep 30, 2026 2:09a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.