fix: escape html notification variables

Encode template variables in HTML bodies while preserving text and subjects. Ref: IT-1115
2026-08-19 23:04:15 +03:00
parent 01c622038d
commit 50033a5bd4
3 changed files with 41 additions and 2 deletions
@@ -40,6 +40,27 @@ public sealed class EmailTemplateRenderingServiceTests
        Assert.Equal("Required template variables are missing: VerificationUrl.", exception.Message);
    }

+    [Fact]
+    public void Render_HtmlEncodesVariablesWithoutChangingSubjectOrTextBody()
+    {
+        EmailTemplate template = CreateTemplate();
+        SendEmailMessageData data = CreateData(new Dictionary<string, string>
+        {
+            ["AppName"] = "Invemory <script>alert('xss')</script>",
+            ["VerificationUrl"] = "https://example.invalid/verify?next=\" onclick=\"alert('xss')"
+        });
+
+        RenderedEmail result = _service.Render(template, data);
+
+        Assert.Equal("Verify Invemory <script>alert('xss')</script>", result.Subject);
+        Assert.Equal(
+            "<a href=\"https://example.invalid/verify?next=&quot; onclick=&quot;alert(&#39;xss&#39;)\">Verify</a>",
+            result.HtmlBody);
+        Assert.Equal(
+            "Verify at https://example.invalid/verify?next=\" onclick=\"alert('xss')",
+            result.TextBody);
+    }
+
    private static EmailTemplate CreateTemplate() => new()
    {
        ServiceName = "StoreMate-Prod",