feat: improved discount email

Author: BolverBlitz

config/templates/email/Discounts.ejs

@@ -17,6 +17,11 @@
             </li>
         <% }) %>
     </ul>
-    <% if (domain) { %><p><a href="<%= domain %>"><%= application %></a></p><% } %>
+    <p><%= t('emails.Discounts.disclaimer') %></p>
+    <p><%- tHtml('emails.footer_subscribe', {
+        application,
+        settingsUrl: `${domain}/settings`,
+        settingsLabel: t('emails.settings')
+    }) %></p>
 </body>
 </html>

config/templates/email/locales/de.json

@@ -1,6 +1,8 @@
 {
     "emails": {
         "greeting": "Hallo {{name}},",
+        "settings": "Einstellungen",
+        "footer_subscribe": "Du erhältst diese E-Mail, weil du Benachrichtigungen von {{application}} abonniert hast. Du kannst deine Benachrichtigungseinstellungen in den <a href=\"{{settingsUrl}}\">{{settingsLabel}}</a> anpassen.",
         "RegMail": {
             "subject": "Willkommen bei {{application}}",
             "heading": "Willkommen bei {{application}}",
@@ -17,6 +19,7 @@
             "subject": "Aktuelle Angebote bei {{application}}",
             "heading": "Aktuelle Angebote",
             "body": "Diese Artikel sind aktuell reduziert:",
+            "disclaimer": "Die Angebote gelten bis zum angegebenen Zeitpunkt und nur solange der Vorrat reicht",
             "until": "bis {{date}}",
             "text": "Hallo {{name}},\n\nBei {{application}} gibt es aktuell neue Angebote. Öffne die Anwendung, um sie anzusehen."
         },

lib/notifications.js

@@ -183,6 +183,20 @@ const buildEmail = async (task) => {
         ? task.language
         : fallbackLanguage;
     const t = i18n.getFixedT(language);
+    const escapeHtml = (value) => String(value)
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+    const tHtml = (key, options = {}) => t(key, {
+        ...options,
+        interpolation: {
+            ...options.interpolation,
+            escapeValue: true,
+            escape: escapeHtml,
+        },
+    });
     const extraContext = await definition.buildContext(task);
     const context = {
         name: task.name,
@@ -194,6 +208,7 @@ const buildEmail = async (task) => {
         message: task.custom_message || '',
         language,
         t,
+        tHtml,
         ...(extraContext || {}),
     };
     const html = await ejs.renderFile(definition.templatePath, context);

test/notifications.test.js

@@ -115,6 +115,36 @@ test('buildEmail renders selected discounts', async () => {
     assert.match(email.subject, /Angebote/);
     assert.match(email.html, /Testartikel/);
     assert.match(email.html, /1\.50/);
+    assert.match(email.html, /<a href="(?:https?:\/\/[^"]+)?\/settings">Einstellungen<\/a>/);
+    assert.doesNotMatch(email.html, /&lt;a href=|Settings\.Settings/);
+});
+
+test('email HTML translations escape interpolated values', async () => {
+    const previousApplication = process.env.APPLICATION;
+    const previousDomain = process.env.DOMAIN;
+    process.env.APPLICATION = '<script>alert("application")</script>';
+    process.env.DOMAIN = 'https://example.com/" onclick="alert(1)';
+
+    try {
+        const email = await buildEmail({
+            type: 'Discounts',
+            name: 'Ada',
+            username: 'ada',
+            email: 'ada@example.com',
+            uuid: 'test-uuid',
+            language: 'de',
+            custom_message: JSON.stringify({ items: [] }),
+        });
+
+        assert.doesNotMatch(email.html, /<script>|onclick="/);
+        assert.match(email.html, /&lt;script&gt;/);
+        assert.match(email.html, /&quot; onclick=&quot;/);
+    } finally {
+        if (previousApplication === undefined) delete process.env.APPLICATION;
+        else process.env.APPLICATION = previousApplication;
+        if (previousDomain === undefined) delete process.env.DOMAIN;
+        else process.env.DOMAIN = previousDomain;
+    }
 });
 
 test('features can register notification types, templates, and translations', async () => {