3 files changed, 19 insertions, 6 deletions
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua
index 836841f..eca31ee 100644
--- a/custom/extensions/email-gravatar.lua
+++ b/custom/extensions/email-gravatar.lua
@@ -81,9 +81,12 @@ local function normalize_email(email)
 	if email == nil then
 		return nil
 	end
-	local inner = email:match("<(.*)>")
-	if inner ~= nil then
-		email = inner
+	-- The first "<" and the last ">" are found directly, because "<(.*)>"
+	-- backtracks to the end of the address from every "<" in it.
+	local open = email:find("<", 1, true)
+	local close = email:find(">[^>]*$")
+	if open and close and close > open then
+		email = email:sub(open + 1, close - 1)
 	end
 	email = trim(email):lower()
 	if email == "" then
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua
index 2b1fecd..3422dc1 100644
--- a/custom/extensions/email-libravatar.lua
+++ b/custom/extensions/email-libravatar.lua
@@ -79,9 +79,12 @@ local function normalize_email(email)
 	if email == nil then
 		return nil
 	end
-	local inner = email:match("<(.*)>")
-	if inner ~= nil then
-		email = inner
+	-- The first "<" and the last ">" are found directly, because "<(.*)>"
+	-- backtracks to the end of the address from every "<" in it.
+	local open = email:find("<", 1, true)
+	local close = email:find(">[^>]*$")
+	if open and close and close > open then
+		email = email:sub(open + 1, close - 1)
 	end
 	email = trim(email):lower()
 	if email == "" then
diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.lua
index bedcfe8..b4a4545 100644
--- a/tests/extensions/test-email-avatar.lua
+++ b/tests/extensions/test-email-avatar.lua
@@ -83,6 +83,13 @@ local started = os.clock()
 render("<a" .. string.rep(" ", 40000) .. "b>", "x")
 h.check("a long run of inner spaces is trimmed quickly", os.clock() - started < 0.5)
 
+started = os.clock()
+render(string.rep("<", 40000), "x")
+h.check("a long run of open brackets is unwrapped quickly", os.clock() - started < 0.5)
+
+h.check("the outermost brackets are the ones taken off",
+	hash_of(render("x <author@example.com> y", "x")) == plain)
+
 if mode == "real" then
 	out = render("test@example.com", "x")
 	h.equals("a known address hashes to its published md5", hash_of(out), "55502f40dc8b7c769880b10874abc9d0")