Add anchor for incoming email regex, closes 44989

changelogs/unreleased/ccr-incoming-email-regex-anchor.yml

@@ -0,0 +1,3 @@
+title: Add anchor for incoming email regex
+merge_request: !18917
+type: added

lib/gitlab/incoming_email.rb

@@ -57,7 +57,7 @@ module Gitlab
 
         regex = Regexp.escape(wildcard_address)
         regex = regex.sub(Regexp.escape(WILDCARD_PLACEHOLDER), '(.+)')
-        Regexp.new(regex).freeze
+        Regexp.new(/\A#{regex}\z/).freeze
       end
     end
   end

spec/lib/gitlab/incoming_email_spec.rb

@@ -83,6 +83,10 @@ describe Gitlab::IncomingEmail do
     it "returns reply key" do
       expect(described_class.key_from_address("replies+key@example.com")).to eq("key")
     end
+
+    it 'does not match emails with extra bits' do
+      expect(described_class.key_from_address('somereplies+somekey@example.com.someotherdomain.com')).to be nil
+    end
   end
 
   context 'self.key_from_fallback_message_id' do