fix: escape html notification variables

Encode template variables in HTML bodies while preserving text and subjects. Ref: IT-1115
2026-08-19 23:04:15 +03:00
parent 01c622038d
commit 50033a5bd4
3 changed files with 41 additions and 2 deletions
@@ -112,3 +112,7 @@ flowchart TD
    M -->|retries exhausted| N[Publish terminal failure result]
    N --> O[Nack original delivery without requeue]
 ```
+
+Template variables are treated as plain text. The worker HTML-encodes every variable while
+rendering `HtmlBody`; subject and plain-text body interpolation preserve the original value.
+Templates must express markup in `body.html` instead of supplying HTML through variables.