jonny
/
MBO-Tech-IT-Webseite
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: escape user-supplied email in FamilyGuard flyer notification HTML

This commit is contained in:
MBO-Tech-IT 2026-07-21 11:31:42 +02:00
parent e3fad32b6b
commit d9d82d8e7b
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/mailer.ts
View File

@ -1,6 +1,15 @@
import nodemailer from "nodemailer"; import nodemailer from "nodemailer";
import { queueEmail } from "./email-queue"; import { queueEmail } from "./email-queue";
function escapeHtml(value: string): string {
return value
.replace(/&/g, "&")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;");
}
// Port 587 = STARTTLS, Port 465 = SSL/TLS // Port 587 = STARTTLS, Port 465 = SSL/TLS
const transporter = nodemailer.createTransport({ const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST, host: process.env.SMTP_HOST,
@ -228,7 +237,7 @@ export async function sendeFlyerBenachrichtigung(
Ein Interessent hat den MBO FamilyGuard Flyer angefordert. Ein Interessent hat den MBO FamilyGuard Flyer angefordert.
</p> </p>
<table style="width:100%;border-collapse:collapse"> <table style="width:100%;border-collapse:collapse">
<tr><td style="padding:6px 0;color:#94a3b8;width:120px">E-Mail</td><td style="padding:6px 0"><a href="mailto:${data.email}" style="color:#60a5fa">${data.email}</a></td></tr> <tr><td style="padding:6px 0;color:#94a3b8;width:120px">E-Mail</td><td style="padding:6px 0"><a href="mailto:${escapeHtml(data.email)}" style="color:#60a5fa">${escapeHtml(data.email)}</a></td></tr>
</table> </table>
</div> </div>
<div style="padding:12px 24px;background:#111925;border-top:1px solid rgba(255,255,255,0.1)"> <div style="padding:12px 24px;background:#111925;border-top:1px solid rgba(255,255,255,0.1)">