From d9d82d8e7be45e5884f0f58248280c262bcab389 Mon Sep 17 00:00:00 2001 From: MBO-Tech-IT Date: Tue, 21 Jul 2026 11:31:42 +0200 Subject: [PATCH] fix: escape user-supplied email in FamilyGuard flyer notification HTML --- lib/mailer.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/mailer.ts b/lib/mailer.ts index 09acd77..f03013f 100644 --- a/lib/mailer.ts +++ b/lib/mailer.ts @@ -1,6 +1,15 @@ import nodemailer from "nodemailer"; import { queueEmail } from "./email-queue"; +function escapeHtml(value: string): string { + return value + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} + // Port 587 = STARTTLS, Port 465 = SSL/TLS const transporter = nodemailer.createTransport({ host: process.env.SMTP_HOST, @@ -228,7 +237,7 @@ export async function sendeFlyerBenachrichtigung( Ein Interessent hat den MBO FamilyGuard Flyer angefordert.

- +
E-Mail${data.email}
E-Mail${escapeHtml(data.email)}