[FIX] RDSC-67 XSS exploit

nascimj · nascimj · commit ca4d56c8a528 · 2026-03-16T10:43:45.000+01:00
diff --git a/lib/mail-parser.js b/lib/mail-parser.js
@@ -1120,7 +1120,9 @@ class MailParser extends Transform {
                             result.push(textPart);
                         }
 
-                        result.push(`<a href="${link.url}">${link.text}</a>`);
+                        result.push(
+                            `<a href="${he.encode(link.url, { useNamedReferences: true })}">${he.encode(link.text, { useNamedReferences: true })}</a>`
+                        );
 
                         last = link.lastIndex;
                     });

Original file line number	Diff line number	Diff line change
`@@ -1120,7 +1120,9 @@ class MailParser extends Transform {`
`1120`	`1120`	`result.push(textPart);`
`1121`	`1121`	`}`
`1122`	`1122`
`1123`		- result.push(`<a href="${link.url}">${link.text}</a>`);
	`1123`	`+ result.push(`
	`1124`	+ `<a href="${he.encode(link.url, { useNamedReferences: true })}">${he.encode(link.text, { useNamedReferences: true })}</a>`
	`1125`	`+ );`
`1124`	`1126`
`1125`	`1127`	`last = link.lastIndex;`
`1126`	`1128`	`});`