fix: escape html notification variables

Encode template variables in HTML bodies while preserving text and subjects. Ref: IT-1115
2026-08-19 23:04:15 +03:00
parent 01c622038d
commit 50033a5bd4
3 changed files with 41 additions and 2 deletions
@@ -1,5 +1,6 @@
 namespace HrynCo.NotificationService.Worker.Services.EmailProcessing;

+using System.Net;
 using System.Text;
 using HrynCo.NotificationService.Contracts.Messages;
 using HrynCo.NotificationService.DAL.Abstract.Templates;
@@ -22,15 +23,28 @@ internal sealed class EmailTemplateRenderingService : IEmailTemplateRenderingSer

        return new RenderedEmail(
            Interpolate(template.Subject, data.Variables),
-            Interpolate(template.HtmlBody, data.Variables),
+            InterpolateHtml(template.HtmlBody, data.Variables),
            Interpolate(template.TextBody, data.Variables));
    }

+    private static string InterpolateHtml(string text, IReadOnlyDictionary<string, string> variables)
+    {
+        return Interpolate(text, variables, WebUtility.HtmlEncode);
+    }
+
    private static string Interpolate(string text, IReadOnlyDictionary<string, string> variables)
+    {
+        return Interpolate(text, variables, static value => value);
+    }
+
+    private static string Interpolate(
+        string text,
+        IReadOnlyDictionary<string, string> variables,
+        Func<string, string> encodeValue)
    {
        var sb = new StringBuilder(text);
        foreach (var (key, value) in variables)
-            sb.Replace($"{{{{{key}}}}}", value);
+            sb.Replace($"{{{{{key}}}}}", encodeValue(value));
        return sb.ToString();
    }
 }