Nick SzaunigandClaude Opus 5.5
cef2248a45
Customer input (first name, address, product names), order data, admin fields (company data, carrier, tracking number) and URLs were inserted into email HTML unescaped. A first name such as <a href="…">…</a> ended up as a working link in a genuine shop email, usable for phishing. All variable values in email HTML now go through escapeHtml (lib/escape-html.ts, shared with the withdrawal receipt). Button links only accept http(s), so a javascript: tracking URL is dropped. The plain text part stays unescaped. Tests cover order confirmation, shipment, status mails, layout company data and back-in-stock mails. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
15 lines
524 B
TypeScript
15 lines
524 B
TypeScript
/**
|
|
* Maskiert Text fuer die Ausgabe in HTML (Element-Inhalt und Attributwerte in
|
|
* doppelten oder einfachen Anfuehrungszeichen). Pflicht fuer JEDEN Wert aus
|
|
* Nutzereingaben, Datenbank oder Admin-Feldern, der in selbst gebautes HTML
|
|
* wandert — vor allem in E-Mails, wo React nicht automatisch maskiert.
|
|
*/
|
|
export function escapeHtml(value: string): string {
|
|
return value
|
|
.replace(/&/g, "&")
|
|
.replace(/</g, "<")
|
|
.replace(/>/g, ">")
|
|
.replace(/"/g, """)
|
|
.replace(/'/g, "'");
|
|
}
|