From eb0190cebc9e9b27f19df508d51976421f618688 Mon Sep 17 00:00:00 2001 From: Frank Karlitschek Date: Wed, 22 Jul 2026 19:55:11 +0200 Subject: [PATCH] fix(mail): escape rich-object link when building HTML email subject The link parameter of rich subject parameters was interpolated into the href attribute of notification and digest emails without escaping, allowing attribute/markup injection into outgoing mail by any activity provider or federated source whose link contains a double quote. Escape the link with htmlspecialchars(ENT_QUOTES), matching the escaping already applied to the link text. Signed-off-by: Frank Karlitschek Co-Authored-By: Claude Fable 5 --- lib/DigestSender.php | 2 +- lib/MailQueueHandler.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/DigestSender.php b/lib/DigestSender.php index 0dfe4d380..5acbdb86b 100644 --- a/lib/DigestSender.php +++ b/lib/DigestSender.php @@ -235,7 +235,7 @@ protected function getHTMLSubject(IEvent $event): string { } if (isset($parameter['link'])) { - $replacements[] = '' . htmlspecialchars($replacement) . ''; + $replacements[] = '' . htmlspecialchars($replacement) . ''; } else { $replacements[] = '' . htmlspecialchars($replacement) . ''; } diff --git a/lib/MailQueueHandler.php b/lib/MailQueueHandler.php index ee68dba79..d130af69f 100644 --- a/lib/MailQueueHandler.php +++ b/lib/MailQueueHandler.php @@ -393,7 +393,7 @@ protected function getHTMLSubject(IEvent $event): string { } if (isset($parameter['link'])) { - $replacements[] = '' . htmlspecialchars($replacement) . ''; + $replacements[] = '' . htmlspecialchars($replacement) . ''; } else { $replacements[] = '' . htmlspecialchars($replacement) . ''; }