Skip to content

Commit 5248232

Browse files
zeripathzeripath
authored
Try to prevent autolinking of displaynames by email readers (#19169)
Unfortunately many email readers will (helpfully) detect url or url-like names and automatically create links to them, even in HTML emails. This is not ideal when usernames can have dots in them. This PR tries to prevent this behaviour by sticking ZWJ characters between dots and also set the meta tag to prevent format detection. Not every email template has been changed in this way - just the activation emails but it may be that we should be setting the above meta tag in all of our emails too. Signed-off-by: Andrew Thornton <[email protected]>
1 parent 3f280f8 commit 5248232

File tree

8 files changed

+38
-22
lines changed

8 files changed

+38
-22
lines changed

‎modules/templates/helper.go

+5
Original file line numberDiff line numberDiff line change
@@ -632,6 +632,11 @@ func JSEscape(raw string) string {
632632
return template.JSEscapeString(raw)
633633
}
634634

635+
// DotEscape wraps a dots in names with ZWJ [U+200D] in order to prevent autolinkers from detecting these as urls
636+
func DotEscape(raw string) string {
637+
return strings.ReplaceAll(raw, ".", "\u200d.\u200d")
638+
}
639+
635640
// Sha1 returns sha1 sum of string
636641
func Sha1(str string) string {
637642
return base.EncodeSha1(str)

‎services/mailer/mail.go

+15-10
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,9 @@ func sendUserMail(language string, u *user_model.User, tpl base.TplName, code, s
7878
"Code": code,
7979
"Language": locale.Language(),
8080
// helper
81-
"i18n": locale,
82-
"Str2html": templates.Str2html,
81+
"i18n": locale,
82+
"Str2html": templates.Str2html,
83+
"DotEscape": templates.DotEscape,
8384
}
8485

8586
var content bytes.Buffer
@@ -128,8 +129,9 @@ func SendActivateEmailMail(u *user_model.User, email *user_model.EmailAddress) {
128129
"Email": email.Email,
129130
"Language": locale.Language(),
130131
// helper
131-
"i18n": locale,
132-
"Str2html": templates.Str2html,
132+
"i18n": locale,
133+
"Str2html": templates.Str2html,
134+
"DotEscape": templates.DotEscape,
133135
}
134136

135137
var content bytes.Buffer
@@ -158,8 +160,9 @@ func SendRegisterNotifyMail(u *user_model.User) {
158160
"Username": u.Name,
159161
"Language": locale.Language(),
160162
// helper
161-
"i18n": locale,
162-
"Str2html": templates.Str2html,
163+
"i18n": locale,
164+
"Str2html": templates.Str2html,
165+
"DotEscape": templates.DotEscape,
163166
}
164167

165168
var content bytes.Buffer
@@ -191,8 +194,9 @@ func SendCollaboratorMail(u, doer *user_model.User, repo *repo_model.Repository)
191194
"Link": repo.HTMLURL(),
192195
"Language": locale.Language(),
193196
// helper
194-
"i18n": locale,
195-
"Str2html": templates.Str2html,
197+
"i18n": locale,
198+
"Str2html": templates.Str2html,
199+
"DotEscape": templates.DotEscape,
196200
}
197201

198202
var content bytes.Buffer
@@ -275,8 +279,9 @@ func composeIssueCommentMessages(ctx *mailCommentContext, lang string, recipient
275279
"ReviewComments": reviewComments,
276280
"Language": locale.Language(),
277281
// helper
278-
"i18n": locale,
279-
"Str2html": templates.Str2html,
282+
"i18n": locale,
283+
"Str2html": templates.Str2html,
284+
"DotEscape": templates.DotEscape,
280285
}
281286

282287
var mailSubject bytes.Buffer

‎services/mailer/mail_release.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,9 @@ func mailNewRelease(ctx context.Context, lang string, tos []string, rel *models.
7575
"Subject": subject,
7676
"Language": locale.Language(),
7777
// helper
78-
"i18n": locale,
79-
"Str2html": templates.Str2html,
78+
"i18n": locale,
79+
"Str2html": templates.Str2html,
80+
"DotEscape": templates.DotEscape,
8081
}
8182

8283
var mailBody bytes.Buffer

‎services/mailer/mail_repo.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,9 @@ func sendRepoTransferNotifyMailPerLang(lang string, newOwner, doer *user_model.U
7373
"Language": locale.Language(),
7474
"Destination": destination,
7575
// helper
76-
"i18n": locale,
77-
"Str2html": templates.Str2html,
76+
"i18n": locale,
77+
"Str2html": templates.Str2html,
78+
"DotEscape": templates.DotEscape,
7879
}
7980

8081
if err := bodyTemplates.ExecuteTemplate(&content, string(mailRepoTransferNotify), data); err != nil {

‎templates/mail/auth/activate.tmpl

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.activate_account.title" .DisplayName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.activate_account.title" (.DisplayName|DotEscape)}}</title>
67
</head>
78

89
{{ $activate_url := printf "%suser/activate?code=%s" AppUrl (QueryEscape .Code)}}
910
<body>
10-
<p>{{.i18n.Tr "mail.activate_account.text_1" .DisplayName AppName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.activate_account.text_1" (.DisplayName|DotEscape) AppName | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.activate_account.text_2" .ActiveCodeLives | Str2html}}</p><p><a href="{{$activate_url}}">{{$activate_url}}</a></p><br>
1213
<p>{{.i18n.Tr "mail.link_not_working_do_paste"}}</p>
1314

‎templates/mail/auth/activate_email.tmpl

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.activate_email.title" .DisplayName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.activate_email.title" (.DisplayName|DotEscape)}}</title>
67
</head>
78

89
{{ $activate_url := printf "%suser/activate_email?code=%s&email=%s" AppUrl (QueryEscape .Code) (QueryEscape .Email)}}
910
<body>
10-
<p>{{.i18n.Tr "mail.hi_user_x" .DisplayName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.hi_user_x" (.DisplayName|DotEscape) | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.activate_email.text" .ActiveCodeLives | Str2html}}</p><p><a href="{{$activate_url}}">{{$activate_url}}</a></p><br>
1213
<p>{{.i18n.Tr "mail.link_not_working_do_paste"}}</p>
1314

‎templates/mail/auth/register_notify.tmpl

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.register_notify.title" .DisplayName AppName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.register_notify.title" (.DisplayName|DotEscape) AppName}}</title>
67
</head>
78

89
{{$set_pwd_url := printf "%[1]suser/forgot_password" AppUrl}}
910
<body>
10-
<p>{{.i18n.Tr "mail.hi_user_x" .DisplayName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.hi_user_x" (.DisplayName|DotEscape) | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.register_notify.text_1" AppName}}</p><br>
1213
<p>{{.i18n.Tr "mail.register_notify.text_2" .Username}}</p><p><a href="{{AppUrl}}user/login">{{AppUrl}}user/login</a></p><br>
1314
<p>{{.i18n.Tr "mail.register_notify.text_3" ($set_pwd_url | Escape) | Str2html}}</p><br>

‎templates/mail/auth/reset_passwd.tmpl

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.reset_password.title" .DisplayName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.reset_password.title" (.DisplayName|DotEscape)}}</title>
67
</head>
78

89
{{ $recover_url := printf "%suser/recover_account?code=%s" AppUrl (QueryEscape .Code)}}
910
<body>
10-
<p>{{.i18n.Tr "mail.hi_user_x" .DisplayName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.hi_user_x" (.DisplayName|DotEscape) | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.reset_password.text" .ResetPwdCodeLives | Str2html}}</p><p><a href="{{$recover_url}}">{{$recover_url}}</a></p><br>
1213
<p>{{.i18n.Tr "mail.link_not_working_do_paste"}}</p>
1314

0 commit comments

Comments
 (0)