Sanitize html

twentyhq · martmull · Sep 12, 2024 · Sep 9, 2024 · Sep 9, 2024 · Sep 10, 2024
commit cb33021530d4e6427ede58a328524fb6ae018298
diff --git a/packages/twenty-emails/src/emails/workflow-action.email.tsx b/packages/twenty-emails/src/emails/workflow-action.email.tsx
@@ -1,25 +1,26 @@
 import { BaseEmail } from 'src/components/BaseEmail';
 import { Title } from 'src/components/Title';
-import { MainText } from 'src/components/MainText';
 import { CallToAction } from 'src/components/CallToAction';
 
 type WorkflowActionEmailProps = {
-  mainText?: string;
+  dangerousHTML?: string;
   title?: string;
   callToAction?: {
     value: string;
     href: string;
   };
 };
 export const WorkflowActionEmail = ({
-  mainText,
+  dangerousHTML,
   title,
   callToAction,
 }: WorkflowActionEmailProps) => {
   return (
     <BaseEmail withLogo={false}>
       {title && <Title value={title} />}
-      {mainText && <MainText>{mainText}</MainText>}
+      {dangerousHTML && (
+        <div dangerouslySetInnerHTML={{ __html: dangerousHTML }} />
+      )}
       {callToAction && (
         <CallToAction value={callToAction.value} href={callToAction.href} />
       )}

diff --git a/...server/src/modules/workflow/common/types/settings/workflow-system-action-settings.type.ts b/...server/src/modules/workflow/common/types/settings/workflow-system-action-settings.type.ts
@@ -6,7 +6,7 @@ type BaseSystemActionSettings = BaseWorkflowSettings & {
 };
 
 export type WorkflowSystemSendEmailActionSettings = BaseSystemActionSettings & {
-  subject: string;
+  subject?: string;
   template?: string;
   title?: string;
   callToAction?: {

diff --git a/.../src/modules/workflow/workflow-system-action/workflow-system-actions/send-email-action.ts b/.../src/modules/workflow/workflow-system-action/workflow-system-actions/send-email-action.ts
@@ -2,6 +2,8 @@ import { Injectable } from '@nestjs/common';
 
 import { WorkflowActionEmail } from 'twenty-emails';
 import { render } from '@react-email/components';
+import { JSDOM } from 'jsdom';
+import DOMPurify from 'dompurify';
 
 import { WorkflowSystemAction } from 'src/modules/workflow/workflow-system-action/workflow-system-action.interface';
 import { WorkflowSystemStep } from 'src/modules/workflow/common/types/workflow-step.type';
@@ -35,9 +37,12 @@ export class SendEmailAction implements WorkflowSystemAction {
           (mainText = mainText?.replace(`{{${key}}}`, payload[key])),
       );
     }
+    const window = new JSDOM('').window;
+    const purify = DOMPurify(window);
+    const safeHTML = purify.sanitize(mainText || '');
 
     const email = WorkflowActionEmail({
-      mainText: mainText,
+      dangerousHTML: safeHTML,
       title: step.settings.title,
       callToAction: step.settings.callToAction,
     });
@@ -53,7 +58,7 @@ export class SendEmailAction implements WorkflowSystemAction {
         'EMAIL_FROM_NAME',
       )} <${this.environmentService.get('EMAIL_FROM_ADDRESS')}>`,
       to: payload.email,
-      subject: step.settings.subject,
+      subject: step.settings.subject || '',
       text,
       html,
     });