fix: encode notification content in HTML email
Notification emails interpolated display names, titles, messages and URLs directly into HTML. Encode dynamic text and quoted attributes at the shared email renderer, including the Outlook action link, using the existing html-escaper dependency. Subject headers and plain-text bodies retain their original text.
The existing regex formatters remain compatibility formatters; misleading comments claiming they provide XSS protection are removed. Profile bio and in-app notification consumers render text through React. Markdown uses its separate HTML sanitization path.
Validation: four injection regressions failed before the fix; all five renderer tests and 43 notification-service tests pass with a mocked mail transport. Normal publication hooks passed lint, generated types and all 3,796 tests. No email was sent.
Uses the established OWASP context-specific output encoding practice.
Refs #442.
Summary by cubic
Encodes dynamic notification content and URLs before inserting them into HTML emails, so markup is displayed as text instead of being interpreted. Subject headers and plain-text bodies keep their original text.
- Adds regression tests for injected markup, quoted URLs, Unicode, and legitimate links, and clarifies that legacy regex formatters do not provide XSS protection.
Summary by CodeRabbit
- Bug Fixes
- Notification emails now safely handle markup and special characters in subjects, titles, messages, and links, preventing them from being interpreted as HTML. Plain-text email content remains unchanged.
- Email links and branding URLs are also safely displayed when they contain special characters, while legitimate report links continue to work.