umputun / remark42 / 28471133394

84%

master: 85%

Pull #2093

github

Sanitize comment text in email notifications (GHSA-74pc-3r2m-ppx3)

Email notification templates rendered the comment HTML via text/template,
so the store-level UGC sanitizer's permitted <a> and <img> tags reached
the email body verbatim. An authenticated user could plant phishing links
and remote tracking pixels in notification emails sent from the legitimate
remark42 address.

Switch notify to html/template (auto-escaping every non-HTML field) and
add a stricter email-only bluemonday policy that drops <a> and <img> while
keeping basic text formatting; the sanitized comment HTML is passed as
template.HTML. Add regression tests asserting links and images are stripped
while anchor text and formatting survive.

17 of 17 new or added lines in 1 file covered. (100.0%)

6380 of 7566 relevant lines covered (84.32%)

34.57 hits per line