sec: add RFC 5321 email length cap to contact routes and tenant validation #839

Summary

Two of three contact endpoints and tenant validation lack email length limits. RFC 5321 caps emails at 254 characters. Without a length guard, arbitrarily long email strings are processed by the regex engine unnecessarily.

Affected Files

• apps/marketing/src/app/api/contact/route.ts:67 — public, unauthenticated, no length check
• apps/web/src/app/api/internal/contact/route.ts:37 — bearer-token-gated, no length check
• apps/control-plane/src/validation/tenant-validation.ts:35-38 — no length check

Already Addressed

• apps/web/src/app/api/contact/route.ts:19 — uses z.string().email().max(254) via Zod ✅

Recommended Fix

Add email.length > 254 early-return before regex validation in all three files.

Severity

Low — defense-in-depth. The email regex is now linear-time (fixed in #838), so this is a belt-and-suspenders measure.

Last reviewed: 2026-04-08 — identified during ReDoS triage (CodeQL #102, #103, #124)