From 8b0ff622f6b3abce728c88e548efe485f7d8e889 Mon Sep 17 00:00:00 2001
From: Bobby Ho
Date: Tue, 25 Aug 2026 14:02:33 -0700
Subject: [PATCH] fix(coderd/notifications): HTML-escape the email template
values (#28397)
Follows #28340, now merged.
`smtp.go` renders the notification title through
`PlaintextFromMarkdown`, which strips Markdown **and decodes HTML
entities**, then stores the result in `Labels["_subject"]`.
`html.gotmpl` interpolated that raw into `Codestin Search App
```
Markdown escaping cannot reach this. `&` is not backslash-escapable in
either renderer, and this path never enters gomarkdown, so neither
`html.SkipHTML` nor the `Safelink` added in #28340 sees the string. `{{
.UserName }}` was interpolated raw at the same template, straight from
the unescaped payload the dispatcher receives.
This PR adds `| html` to seven values across eleven positions in
`html.gotmpl`:
| Value | Positions | Why |
|---|---|---|
| `.Labels._subject` | 2 | the injection above, in `Codestin Search App
+ Codestin Search App
@@ -11,23 +11,23 @@
- {{ .Labels._subject }}
+ {{ .Labels._subject | html }}
-
Hi {{ .UserName }},
+
Hi {{ .UserName | html }},
{{ .Labels._body }}
`,
+ },
+ {
+ name: "RawHTMLInUserName",
+ title: "Account suspended",
+ userName: `Bobby `,
+ injected: ``,
+ },
+ {
+ name: "RawHTMLInActionLabel",
+ title: "Account suspended",
+ userName: "Bobby",
+ actions: []types.TemplateAction{
+ {Label: ``, URL: "https://coder.example.com/"},
+ },
+ injected: ``,
+ },
+ {
+ name: "RawHTMLInActionURL",
+ title: "Account suspended",
+ userName: "Bobby",
+ actions: []types.TemplateAction{
+ {Label: "Open Coder", URL: `https://coder.example.com/?x=`},
+ },
+ injected: ``,
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ // Decodes the entities, so the title arrives as live markup.
+ subject, err := markdown.PlaintextFromMarkdown(tc.title)
+ require.NoError(t, err)
+
+ // Actions are set as the template sees them. The enqueuer renders
+ // them into JSON first, which rejects a `"` of its own accord.
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: tc.userName,
+ Actions: tc.actions,
+ Labels: map[string]string{
+ "_subject": subject,
+ "_body": "Test body
",
+ },
+ }
+
+ got, err := render.GoTemplate(htmlTemplate, payload, templateHelpers())
+ require.NoError(t, err)
+
+ escaped := html.EscapeString(tc.injected)
+ require.NotEqual(t, tc.injected, escaped,
+ "case carries no HTML to escape, so it guards nothing")
+
+ require.NotContains(t, got, tc.injected,
+ "untrusted markup reached the rendered email: %s", got)
+ require.Contains(t, got, escaped,
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
t.Parallel()
@@ -28,12 +120,9 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
"_body": "Test body
",
},
}
- helpers := map[string]any{
- "base_url": func() string { return "https://coder.example.com" },
- "current_year": func() string { return "2026" },
- "logo_url": func() string { return logoURL },
- "app_name": func() string { return appName },
- }
+ helpers := templateHelpers()
+ helpers["logo_url"] = func() string { return logoURL }
+ helpers["app_name"] = func() string { return appName }
got, err := render.GoTemplate(htmlTemplate, payload, helpers)
require.NoError(t, err)
@@ -44,6 +133,65 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
require.False(t, strings.Contains(got, logoURL), "raw logo URL must not be rendered")
}
+// The template escapes every value it interpolates except _body, which is
+// trusted rendered Markdown. The three values here cannot carry markup in
+// production, so this test is the only thing that fails if their escaping is
+// removed.
+func TestSMTPHTMLTemplateEscapesTrustedValues(t *testing.T) {
+ t.Parallel()
+
+ const injected = `a"onclick=alert(1)`
+
+ for _, tc := range []struct {
+ name string
+ apply func(*types.MessagePayload, map[string]any)
+ }{
+ {
+ // net/url preserves a quote in the query and --access-url is
+ // validated for its scheme only, so an operator can land this.
+ name: "BaseURL",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["base_url"] = func() string { return "https://coder.example.com/?q=" + injected }
+ },
+ },
+ {
+ name: "CurrentYear",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["current_year"] = func() string { return injected }
+ },
+ },
+ {
+ name: "NotificationTemplateID",
+ apply: func(p *types.MessagePayload, _ map[string]any) {
+ p.NotificationTemplateID = injected
+ },
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: "Test User",
+ Labels: map[string]string{
+ "_subject": "Test notification",
+ "_body": "Test body
",
+ },
+ }
+ helpers := templateHelpers()
+ tc.apply(&payload, helpers)
+
+ got, err := render.GoTemplate(htmlTemplate, payload, helpers)
+ require.NoError(t, err)
+
+ require.NotContains(t, got, injected,
+ "raw value reached the rendered email: %s", got)
+ require.Contains(t, got, html.EscapeString(injected),
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestValidateFromAddr(t *testing.T) {
t.Parallel()
diff --git a/coderd/notifications/notifier.go b/coderd/notifications/notifier.go
index 19533c04942..e17243e3b6e 100644
--- a/coderd/notifications/notifier.go
+++ b/coderd/notifications/notifier.go
@@ -253,7 +253,9 @@ func (n *notifier) prepare(ctx context.Context, msg database.AcquireNotification
// Label and data values are user-controlled while the templates around them
// are not, so Markdown structure in a value is neutralized before it reaches
// the template. The dispatcher still receives the unescaped payload, because
- // the webhook contract surfaces enqueued values verbatim.
+ // the webhook contract surfaces enqueued values verbatim. smtp/html.gotmpl
+ // escapes at its own sinks, which it must: PlaintextFromMarkdown strips this
+ // escaping back out of _subject.
escaped := payload.EscapedForMarkdown()
var title, body string
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
index 769d5595dbc..b4a2d53763c 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
- Codestin Search App
+ Codestin Search App
- Task 'my-workspace' completed
+ Task 'my-workspace' completed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
index 5d0879bc82d..1a17d690186 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' failed
+ Task 'my-workspace' failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
index 578e39e91a2..0c4fea1cf9d 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' is idle
+ Task 'my-workspace' is idle
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
index 58a1f098f77..f22fc19c5b6 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-task' is paused
+ Task 'my-task' is paused
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
index 81d2498b579..4d71d3c8ec9 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-task' has resumed
+ Task 'my-task' has resumed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
index 21356601f62..b0cc318c350 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' is working
+ Task 'my-workspace' is working
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
index 75af5a264e6..3103a58b97a 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
@@ -27,7 +27,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Template "Bobby's Template" deleted
+ Template "Bobby's Template" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
index 70c27eed186..6eea0d7a8db 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
@@ -35,7 +35,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Template 'alpha' has been deprecated
+ Template 'alpha' has been deprecated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
index 011ef84ebfb..ff4ee4976af 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" activated
+ User account "bobby" activated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
index 6fc619e4129..fa16f497bb9 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" created
+ User account "bobby" created
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
index cfcb22beec1..e52d1b71ab8 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" deleted
+ User account "bobby" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
index 9664bc88924..99cddd3593b 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
@@ -30,7 +30,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" suspended
+ User account "bobby" suspended
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
index 12e29c47ed0..819fc0d0e85 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
@@ -56,10 +56,10 @@ argin: 8px 0 32px; line-height: 1.5;">
- Workspace "bobby-workspace" autobuild failed
+ Workspace "bobby-workspace" autobuild failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
index 350896eb0eb..175cf87ece9 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Your workspace "bobby-workspace" will stop soon
+ Your workspace "bobby-workspace" will stop soon
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
index 9fccba0b1f2..97f6e720a28 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
@@ -28,7 +28,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace 'bobby-workspace' has been created
+ Workspace 'bobby-workspace' has been created
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
index fcc9b57f17b..46ebe956cb2 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" deleted
+ Workspace "bobby-workspace" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
index 7c1f7192b1f..cf1e96a2eda 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" deleted
+ Workspace "bobby-workspace" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
index ea9e1b69795..a6ee986bd9d 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
@@ -34,7 +34,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked as dormant
+ Workspace "bobby-workspace" marked as dormant
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
index e41eeb19fee..97c4d95bdf8 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked as dormant
+ Workspace "bobby-workspace" marked as dormant
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
index 2f7bb2771c8..f1b67ebc39c 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" manual build failed
+ Workspace "bobby-workspace" manual build failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
index 0e70293b090..d971cd94c15 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
@@ -31,7 +31,8 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked for deletion
+ Workspace "bobby-workspace" marked for deletion
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
index 1e65a1eab12..15bffe4a810 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
@@ -27,7 +27,8 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
+
Codestin Search App
+
Codestin Search App
+
Codestin Search App
- Your account "bobby" has been activated
+ Your account "bobby" has been activated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
index 277195a2bd4..74dee947796 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
@@ -25,7 +25,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Your account "bobby" has been suspended
+ Your account "bobby" has been suspended