Escape HTML in preview email subject and text body (#548)

We escape HTML in the preview email's subject and text body. The rest of the email preview remains the same.
beam-community · Oct 9, 2020 · 2650a21 · 2650a21
1 parent 0fcff1b
commit 2650a21
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 6 deletions.
diff --git a/lib/bamboo/plug/sent_email_viewer/helper.ex b/lib/bamboo/plug/sent_email_viewer/helper.ex
@@ -34,6 +34,14 @@ defmodule Bamboo.SentEmailViewerPlug.Helper do
     |> HTML.html_escape()
   end
 
+  def format_subject(subject) do
+    HTML.html_escape(subject || "")
+  end
+
+  def format_text_body(body) do
+    HTML.html_escape(body || "")
+  end
+
   def format_email_address({nil, address}), do: address
 
   def format_email_address({name, address}) do

diff --git a/lib/bamboo/plug/sent_email_viewer/index.html.eex b/lib/bamboo/plug/sent_email_viewer/index.html.eex
@@ -145,18 +145,22 @@
           <a
             class="email-summary <%= Bamboo.SentEmailViewerPlug.Helper.selected_email_class(email, @selected_email) %>"
             href="<%= "#{@base_path}/#{Bamboo.SentEmail.get_id(email)}" %>">
-            <span class="email-summary-subject truncate"><%= email.subject %></span>
+            <span class="email-summary-subject truncate" title="<%= Bamboo.SentEmailViewerPlug.Helper.format_subject(email.subject) %>">
+              <%= Bamboo.SentEmailViewerPlug.Helper.format_subject(email.subject) %>
+            </span>
             <span class="email-summary-recipients truncate">
               <%= Bamboo.SentEmailViewerPlug.Helper.format_email_address(email.from) %>
               to <%= Bamboo.SentEmailViewerPlug.Helper.email_addresses(email) %>
             </span>
-            <span class="email-summary-body-excerpt"><%= email.text_body %></span>
+            <span class="email-summary-body-excerpt">
+              <%= Bamboo.SentEmailViewerPlug.Helper.format_text_body(email.text_body) %>
+            </span>
           </a>
         <% end %>
       </aside>
       <section class="email-detail-pane">
         <section class="email-detail-hero">
-          <span class="email-detail-subject"><%= @selected_email.subject %></span>
+          <span class="email-detail-subject"><%= Bamboo.SentEmailViewerPlug.Helper.format_subject(@selected_email.subject) %></span>
           <span class="email-detail-recipients">
             From <strong><%= Bamboo.SentEmailViewerPlug.Helper.format_email_address(@selected_email.from) %></strong>
             to <strong><%= Bamboo.SentEmailViewerPlug.Helper.email_addresses(@selected_email) %></strong>
@@ -183,7 +187,7 @@
           </p>
 
           <h3 class="email-detail-body-label">Text Body</h3>
-          <pre class="email-detail-body"><%= @selected_email.text_body %></pre>
+          <pre class="email-detail-body"><%= Bamboo.SentEmailViewerPlug.Helper.format_text_body(@selected_email.text_body) %></pre>
         </section>
       </section>
     </main>

diff --git a/lib/mix/start_sent_email_viewer_task.ex b/lib/mix/start_sent_email_viewer_task.ex
@@ -15,7 +15,7 @@ defmodule Mix.Tasks.Bamboo.StartSentEmailViewer do
       Bamboo.Email.new_email(
         from: "me@gmail.com",
         to: "someone@foo.com",
-        subject: "#{index} - This is a long subject for testing truncation",
+        subject: "#{index} - <em>This</em> is a long subject for testing truncation",
         html_body: """
         Check different tag <strong>styling</strong>
 
@@ -32,7 +32,7 @@ defmodule Mix.Tasks.Bamboo.StartSentEmailViewer do
         long to see how it expands on to the next line
 
         Sincerely,
-        Me
+        Me and <em>html tag</em>
         """
       )
       |> Bamboo.Mailer.normalize_addresses()