fix(api): harden webhook payload formatting

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: AchoArnold

api/pkg/emails/event_payload_formatter.go

@@ -23,6 +23,7 @@ func formatEventPayload(payload string) (string, template.HTML) {
 		content = highlightEventPayloadJSON(formattedPayload)
 	}
 
+	// Every payload token is escaped before this trusted wrapper is constructed.
 	richPayload := template.HTML(`<pre style="` + eventPayloadCodeBlockStyle + `">` + content + `</pre>`)
 	return formattedPayload, richPayload
 }
@@ -52,6 +53,7 @@ func highlightEventPayloadJSON(payload string) string {
 			index = end
 		case payload[index] == '-' || isEventPayloadDigit(payload[index]):
 			end := index + 1
+			// json.Indent already validated this as JSON, so this continuation set only sees JSON number bytes.
 			for end < len(payload) && isEventPayloadNumberCharacter(payload[end]) {
 				end++
 			}

api/pkg/emails/event_payload_formatter_test.go

@@ -56,3 +56,58 @@ func TestFormatEventPayloadPreservesInvalidJSONWithoutHighlighting(t *testing.T)
 	assert.NotContains(t, html, `<span style="color:`)
 	assert.Equal(t, 1, strings.Count(html, `<pre style=`))
 }
+
+func TestFormatEventPayloadHandlesTopLevelPayloadShapes(t *testing.T) {
+	tests := []struct {
+		name                string
+		payload             string
+		wantPlain           string
+		wantHTMLContains    []string
+		wantHTMLNotContains []string
+	}{
+		{
+			name:                "empty payload falls back to unhighlighted block",
+			payload:             "",
+			wantPlain:           "",
+			wantHTMLContains:    []string{`<pre style="`, `</pre>`},
+			wantHTMLNotContains: []string{`<span style="color:`},
+		},
+		{
+			name:                "top-level number stays valid JSON",
+			payload:             "42",
+			wantPlain:           "42",
+			wantHTMLContains:    []string{`<span style="color:#953800;">42</span>`},
+			wantHTMLNotContains: []string{`color:#0550AE`},
+		},
+		{
+			name:      "json array stays readable and escaped",
+			payload:   `[{"message":"<b>safe</b>"},true,null,3]`,
+			wantPlain: "[\n  {\n    \"message\": \"<b>safe</b>\"\n  },\n  true,\n  null,\n  3\n]",
+			wantHTMLContains: []string{
+				"[\n  {",
+				`&#34;message&#34;`,
+				`&lt;b&gt;safe&lt;/b&gt;`,
+				`<span style="color:#953800;">3</span>`,
+			},
+			wantHTMLNotContains: []string{`<b>safe</b>`},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			plain, rich := formatEventPayload(tt.payload)
+			html := string(rich)
+
+			assert.Equal(t, tt.wantPlain, plain)
+			assert.Equal(t, 1, strings.Count(html, `<pre style=`))
+
+			for _, want := range tt.wantHTMLContains {
+				assert.Contains(t, html, want)
+			}
+
+			for _, unwanted := range tt.wantHTMLNotContains {
+				assert.NotContains(t, html, unwanted)
+			}
+		})
+	}
+}

api/pkg/emails/hermes_notification_email_factory.go

@@ -128,7 +128,7 @@ func (factory *hermesNotificationEmailFactory) WebhookSendFailed(user *entities.
 		return nil, stacktrace.Propagate(err, "cannot generate text email")
 	}
 	// Hermes/html2text collapses dictionary whitespace, so restore the payload after plain-text generation.
-	text = strings.Replace(text, webhookSendFailedEventPayloadPlaceholder, formattedPayload, 1)
+	text = replaceWebhookSendFailedEventPayloadPlaceholder(text, formattedPayload)
 
 	return &Email{
 		ToEmail: user.Email,
@@ -138,6 +138,15 @@ func (factory *hermesNotificationEmailFactory) WebhookSendFailed(user *entities.
 	}, nil
 }
 
+func replaceWebhookSendFailedEventPayloadPlaceholder(text string, formattedPayload string) string {
+	before, after, found := strings.Cut(text, webhookSendFailedEventPayloadPlaceholder)
+	if !found {
+		return text
+	}
+
+	return before + formattedPayload + after
+}
+
 func (factory *hermesNotificationEmailFactory) MessageExpired(user *entities.User, payload *events.MessageSendExpiredPayload) (*Email, error) {
 	email := hermes.Email{
 		Body: hermes.Body{

api/pkg/emails/hermes_notification_email_factory_test.go

@@ -49,6 +49,7 @@ func TestWebhookSendFailedFormatsOnlyEventPayload(t *testing.T) {
 	assert.Contains(t, email.Text, `"message": "hello"`)
 	assert.Contains(t, email.Text, `"retry": false`)
 	assert.NotContains(t, email.Text, "<pre")
+	assert.NotContains(t, email.Text, webhookSendFailedEventPayloadPlaceholder)
 }
 
 func TestWebhookSendFailedPreservesNonJSONEventPayload(t *testing.T) {
@@ -74,3 +75,31 @@ func TestWebhookSendFailedPreservesNonJSONEventPayload(t *testing.T) {
 	assert.NotContains(t, email.HTML, `<span style="color:`)
 	assert.Contains(t, email.Text, "line one\n  line two")
 }
+
+func TestReplaceWebhookSendFailedEventPayloadPlaceholder(t *testing.T) {
+	tests := []struct {
+		name             string
+		text             string
+		formattedPayload string
+		want             string
+	}{
+		{
+			name:             "replaces placeholder and preserves remaining text",
+			text:             "before\n" + webhookSendFailedEventPayloadPlaceholder + "\nafter",
+			formattedPayload: "{\n  \"message\": \"hello\"\n}",
+			want:             "before\n{\n  \"message\": \"hello\"\n}\nafter",
+		},
+		{
+			name:             "returns original text when placeholder is missing",
+			text:             "before\nafter",
+			formattedPayload: "{\n  \"message\": \"hello\"\n}",
+			want:             "before\nafter",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, replaceWebhookSendFailedEventPayloadPlaceholder(tt.text, tt.formattedPayload))
+		})
+	}
+}