Skip to content

fix(security): use html/template for email rendering to prevent SSTI#574

Merged
lakhansamani merged 1 commit into
mainfrom
fix/email-template-injection
Apr 5, 2026
Merged

fix(security): use html/template for email rendering to prevent SSTI#574
lakhansamani merged 1 commit into
mainfrom
fix/email-template-injection

Conversation

@lakhansamani
Copy link
Copy Markdown
Contributor

@lakhansamani lakhansamani commented Apr 4, 2026

Summary

  • Switch from text/template to html/template for email template rendering
  • html/template provides context-aware auto-escaping, preventing server-side template injection via admin-configured email templates
  • API is identical — no functional changes, only security hardening

Files Changed

  • internal/email/email.go — import change from text/template to html/template

Test plan

  • make test-sqlite passes (no regressions)
  • Verify email templates render correctly with HTML content
  • Verify special characters in user data are properly escaped
@lakhansamani lakhansamani merged commit f6565d9 into main Apr 5, 2026
@lakhansamani lakhansamani deleted the fix/email-template-injection branch April 5, 2026 01:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@lakhansamani