Skip to content

Commit 2955f0f

Browse files
zeripathStelios Malathouras
zeripath
authored and
Stelios Malathouras
committed
Try to prevent autolinking of displaynames by email readers (go-gitea#19169)
Unfortunately many email readers will (helpfully) detect url or url-like names and automatically create links to them, even in HTML emails. This is not ideal when usernames can have dots in them. This PR tries to prevent this behaviour by sticking ZWJ characters between dots and also set the meta tag to prevent format detection. Not every email template has been changed in this way - just the activation emails but it may be that we should be setting the above meta tag in all of our emails too. Signed-off-by: Andrew Thornton <[email protected]>
1 parent 59fc31c commit 2955f0f

File tree

8 files changed

+38
-22
lines changed

8 files changed

+38
-22
lines changed

‎modules/templates/helper.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -632,6 +632,11 @@ func JSEscape(raw string) string {
632632
return template.JSEscapeString(raw)
633633
}
634634

635+
// DotEscape wraps a dots in names with ZWJ [U+200D] in order to prevent autolinkers from detecting these as urls
636+
func DotEscape(raw string) string {
637+
return strings.ReplaceAll(raw, ".", "\u200d.\u200d")
638+
}
639+
635640
// Sha1 returns sha1 sum of string
636641
func Sha1(str string) string {
637642
return base.EncodeSha1(str)

‎services/mailer/mail.go

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,9 @@ func sendUserMail(language string, u *user_model.User, tpl base.TplName, code, s
7878
"Code": code,
7979
"Language": locale.Language(),
8080
// helper
81-
"i18n": locale,
82-
"Str2html": templates.Str2html,
81+
"i18n": locale,
82+
"Str2html": templates.Str2html,
83+
"DotEscape": templates.DotEscape,
8384
}
8485

8586
var content bytes.Buffer
@@ -128,8 +129,9 @@ func SendActivateEmailMail(u *user_model.User, email *user_model.EmailAddress) {
128129
"Email": email.Email,
129130
"Language": locale.Language(),
130131
// helper
131-
"i18n": locale,
132-
"Str2html": templates.Str2html,
132+
"i18n": locale,
133+
"Str2html": templates.Str2html,
134+
"DotEscape": templates.DotEscape,
133135
}
134136

135137
var content bytes.Buffer
@@ -158,8 +160,9 @@ func SendRegisterNotifyMail(u *user_model.User) {
158160
"Username": u.Name,
159161
"Language": locale.Language(),
160162
// helper
161-
"i18n": locale,
162-
"Str2html": templates.Str2html,
163+
"i18n": locale,
164+
"Str2html": templates.Str2html,
165+
"DotEscape": templates.DotEscape,
163166
}
164167

165168
var content bytes.Buffer
@@ -191,8 +194,9 @@ func SendCollaboratorMail(u, doer *user_model.User, repo *repo_model.Repository)
191194
"Link": repo.HTMLURL(),
192195
"Language": locale.Language(),
193196
// helper
194-
"i18n": locale,
195-
"Str2html": templates.Str2html,
197+
"i18n": locale,
198+
"Str2html": templates.Str2html,
199+
"DotEscape": templates.DotEscape,
196200
}
197201

198202
var content bytes.Buffer
@@ -275,8 +279,9 @@ func composeIssueCommentMessages(ctx *mailCommentContext, lang string, recipient
275279
"ReviewComments": reviewComments,
276280
"Language": locale.Language(),
277281
// helper
278-
"i18n": locale,
279-
"Str2html": templates.Str2html,
282+
"i18n": locale,
283+
"Str2html": templates.Str2html,
284+
"DotEscape": templates.DotEscape,
280285
}
281286

282287
var mailSubject bytes.Buffer

‎services/mailer/mail_release.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,9 @@ func mailNewRelease(ctx context.Context, lang string, tos []string, rel *models.
7575
"Subject": subject,
7676
"Language": locale.Language(),
7777
// helper
78-
"i18n": locale,
79-
"Str2html": templates.Str2html,
78+
"i18n": locale,
79+
"Str2html": templates.Str2html,
80+
"DotEscape": templates.DotEscape,
8081
}
8182

8283
var mailBody bytes.Buffer

‎services/mailer/mail_repo.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,9 @@ func sendRepoTransferNotifyMailPerLang(lang string, newOwner, doer *user_model.U
7373
"Language": locale.Language(),
7474
"Destination": destination,
7575
// helper
76-
"i18n": locale,
77-
"Str2html": templates.Str2html,
76+
"i18n": locale,
77+
"Str2html": templates.Str2html,
78+
"DotEscape": templates.DotEscape,
7879
}
7980

8081
if err := bodyTemplates.ExecuteTemplate(&content, string(mailRepoTransferNotify), data); err != nil {

‎templates/mail/auth/activate.tmpl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.activate_account.title" .DisplayName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.activate_account.title" (.DisplayName|DotEscape)}}</title>
67
</head>
78

89
{{ $activate_url := printf "%suser/activate?code=%s" AppUrl (QueryEscape .Code)}}
910
<body>
10-
<p>{{.i18n.Tr "mail.activate_account.text_1" .DisplayName AppName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.activate_account.text_1" (.DisplayName|DotEscape) AppName | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.activate_account.text_2" .ActiveCodeLives | Str2html}}</p><p><a href="{{$activate_url}}">{{$activate_url}}</a></p><br>
1213
<p>{{.i18n.Tr "mail.link_not_working_do_paste"}}</p>
1314

‎templates/mail/auth/activate_email.tmpl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.activate_email.title" .DisplayName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.activate_email.title" (.DisplayName|DotEscape)}}</title>
67
</head>
78

89
{{ $activate_url := printf "%suser/activate_email?code=%s&email=%s" AppUrl (QueryEscape .Code) (QueryEscape .Email)}}
910
<body>
10-
<p>{{.i18n.Tr "mail.hi_user_x" .DisplayName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.hi_user_x" (.DisplayName|DotEscape) | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.activate_email.text" .ActiveCodeLives | Str2html}}</p><p><a href="{{$activate_url}}">{{$activate_url}}</a></p><br>
1213
<p>{{.i18n.Tr "mail.link_not_working_do_paste"}}</p>
1314

‎templates/mail/auth/register_notify.tmpl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.register_notify.title" .DisplayName AppName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.register_notify.title" (.DisplayName|DotEscape) AppName}}</title>
67
</head>
78

89
{{$set_pwd_url := printf "%[1]suser/forgot_password" AppUrl}}
910
<body>
10-
<p>{{.i18n.Tr "mail.hi_user_x" .DisplayName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.hi_user_x" (.DisplayName|DotEscape) | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.register_notify.text_1" AppName}}</p><br>
1213
<p>{{.i18n.Tr "mail.register_notify.text_2" .Username}}</p><p><a href="{{AppUrl}}user/login">{{AppUrl}}user/login</a></p><br>
1314
<p>{{.i18n.Tr "mail.register_notify.text_3" ($set_pwd_url | Escape) | Str2html}}</p><br>

‎templates/mail/auth/reset_passwd.tmpl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22
<html>
33
<head>
44
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5-
<title>{{.i18n.Tr "mail.reset_password.title" .DisplayName}}</title>
5+
<meta name="format-detection" content="telephone=no,date=no,address=no,email=no,url=no"/>
6+
<title>{{.i18n.Tr "mail.reset_password.title" (.DisplayName|DotEscape)}}</title>
67
</head>
78

89
{{ $recover_url := printf "%suser/recover_account?code=%s" AppUrl (QueryEscape .Code)}}
910
<body>
10-
<p>{{.i18n.Tr "mail.hi_user_x" .DisplayName | Str2html}}</p><br>
11+
<p>{{.i18n.Tr "mail.hi_user_x" (.DisplayName|DotEscape) | Str2html}}</p><br>
1112
<p>{{.i18n.Tr "mail.reset_password.text" .ResetPwdCodeLives | Str2html}}</p><p><a href="{{$recover_url}}">{{$recover_url}}</a></p><br>
1213
<p>{{.i18n.Tr "mail.link_not_working_do_paste"}}</p>
1314

0 commit comments

Comments
 (0)