fix: escape HTML in exported data

Merged
JU
5mo ago
+96-10

Proposed changes (including videos or screenshots)

This PR hardens Rocket.Chat's HTML data export paths by adding proper output escaping.

Message content, usernames, attachment titles, and uploaded filenames were being written into exported .html files without escaping. As a result, any HTML-like characters in that content could be interpreted by the browser when the export was opened, rather than being displayed as text. This affects both the room "Send file via email" export and the "Download My Data" feature, which share the same code path.

This change applies escapeHTML() to all user-controlled fields at the output sinks in:

  • exportRoomMessagesToFile.ts
  • processDataDownloads.ts
  • sendViaEmail.ts

It also adds a restrictive CSP meta tag to the generated HTML as an additional layer of hardening.

Escaping is a no-op for normal content and also fixes the display of text such as a < b, so there is no behavioral change for legitimate exports.

Also added new tests.

Issue(s)

https://rocketchat.atlassian.net/browse/VLN-417

Steps to test or reproduce

N/A

Further comments

N/A

Summary by CodeRabbit

  • Bug Fixes

    • Improved security in data exports by escaping HTML tags to prevent injection attacks in room messages, user data, and email exports.
    • Enhanced security policies in exported HTML files with stricter Content-Security-Policy restrictions.

  • Tests

    • Added comprehensive test coverage for HTML escaping and XSS prevention in exported data.