From 749e933b24fd156a2eadc04689216a88a9354c5d Mon Sep 17 00:00:00 2001 From: Harikrishna Vora Date: Sat, 7 Feb 2026 22:38:57 +0530 Subject: [PATCH] Potential fix for code scanning alert no. 1: Client-side cross-site scripting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- lib/email.ts | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/lib/email.ts b/lib/email.ts index 3df525b..d092bc3 100644 --- a/lib/email.ts +++ b/lib/email.ts @@ -41,6 +41,16 @@ export async function sendEmail({ to, subject, html }: EmailOptions) { // ADSC Logo URL - hosted on the live website const ADSC_LOGO_URL = 'https://adsc-website-testing.vercel.app/images/brand/logo.png'; +// Basic HTML escaping to prevent HTML injection in email templates +function escapeHtml(value: string): string { + return value + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') + .replace(/'/g, '''); +} + // ADSC Logo HTML component for emails - using hosted image function getADSCLogoHtml(): string { return ` @@ -148,6 +158,14 @@ export function getEventEmailHtml(eventDetails: { date: string; registerUrl?: string; }): string { + const safeName = escapeHtml(eventDetails.name); + const safeDescription = escapeHtml(eventDetails.description); + const safeDate = escapeHtml(eventDetails.date); + const rawRegisterUrl = eventDetails.registerUrl ?? ''; + const safeRegisterUrl = rawRegisterUrl + ? escapeHtml(rawRegisterUrl) + : ''; + return ` @@ -167,7 +185,7 @@ export function getEventEmailHtml(eventDetails: { ${getADSCLogoHtml()}

📅 New Event

-

${eventDetails.name}

+

${safeName}