From ea79d52f72c91075067d9fb6944b6be3e3f3dba6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 11 Aug 2026 12:33:21 +0000
Subject: [PATCH] Escape DSAR request fields in the staff HTML email (OY-07)

buildDsarEmailHtml interpolated user.id, username, email, requestType,
jurisdiction, and the user-controlled details/jurisdiction fields straight
into an HTML email sent to contact@oyme.site. A requester could inject
arbitrary markup (link/section spoofing, phishing) into mail that staff
read.

Add an escapeHtml helper (& first, then < > " ') and wrap every
interpolated value.

- worker/routes/dsar.ts: escapeHtml helper; every ${...} in
  buildDsarEmailHtml wrapped, user.id coerced via String().
- tests/worker/dsar.test.ts: submit details/jurisdiction containing
  <script> and <img onerror> payloads and assert the outgoing email html
  contains the escaped forms and not the raw tags.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015EkRWLSbdRZqE9uCeuuQce
Co-authored-by: jackowayed <18899+jackowayed@users.noreply.github.com>
---
 tests/worker/dsar.test.ts | 39 +++++++++++++++++++++++++++++++++++++++
 worker/routes/dsar.ts     | 21 +++++++++++++++------
 2 files changed, 54 insertions(+), 6 deletions(-)

diff --git a/tests/worker/dsar.test.ts b/tests/worker/dsar.test.ts
index cf0fbce..35bc83e 100644
--- a/tests/worker/dsar.test.ts
+++ b/tests/worker/dsar.test.ts
@@ -71,4 +71,43 @@ describe("dsar", () => {
 		assert.deepEqual(emailPayload?.to, ["contact@oyme.site"]);
 		assert.match(String(emailPayload?.subject), /DSAR delete request/);
 	});
+
+	it("escapes user-controlled HTML in the staff email body", async (t) => {
+		const { env, db } = createTestEnv();
+		const user = seedUser(db, { username: "DsarUser", email: "u@example.com" });
+		seedSession(db, user.id, "dsar-token");
+
+		let emailPayload: Record<string, unknown> | null = null;
+		const originalFetch = globalThis.fetch;
+		globalThis.fetch = async (_input, init) => {
+			if (init?.body && typeof init.body === "string") {
+				emailPayload = JSON.parse(init.body) as Record<string, unknown>;
+			}
+			return { ok: true, json: async () => ({ id: "email_123" }) } as Response;
+		};
+		t.after(() => {
+			globalThis.fetch = originalFetch;
+		});
+
+		const { res, json } = await jsonRequest(env, "/api/dsar", {
+			method: "POST",
+			headers: { "x-session-token": "dsar-token" },
+			body: {
+				requestType: "access",
+				jurisdiction: "<img src=x onerror=alert(1)>",
+				details: "<script>alert(1)</script>",
+			},
+		});
+
+		assert.equal(res.status, 200);
+		assert.equal(json.success, true);
+		assert.ok(emailPayload);
+		const html = String(emailPayload?.html);
+		// Escaped forms are present.
+		assert.ok(html.includes("&lt;script&gt;alert(1)&lt;/script&gt;"));
+		assert.ok(html.includes("&lt;img src=x onerror=alert(1)&gt;"));
+		// Raw markup is not.
+		assert.ok(!html.includes("<script>"));
+		assert.ok(!html.includes("<img "));
+	});
 });
diff --git a/worker/routes/dsar.ts b/worker/routes/dsar.ts
index e0dfbb4..5bb1afd 100644
--- a/worker/routes/dsar.ts
+++ b/worker/routes/dsar.ts
@@ -17,6 +17,15 @@ const allowedTypes: ReadonlySet<DsarRequestType> = new Set([
 	"restrict",
 ]);
 
+function escapeHtml(value: string): string {
+	return value
+		.replace(/&/g, "&amp;")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;")
+		.replace(/'/g, "&#39;");
+}
+
 function buildDsarEmailHtml(input: {
 	user: User;
 	requestType: DsarRequestType;
@@ -33,13 +42,13 @@ function buildDsarEmailHtml(input: {
 <body style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f5; padding: 24px; margin: 0;">
   <div style="max-width: 640px; margin: 0 auto; background: #ffffff; border-radius: 12px; padding: 24px;">
     <h1 style="margin: 0 0 16px; font-size: 22px; color: #111;">DSAR Request</h1>
-    <p style="margin: 0 0 8px; color: #333;"><strong>User ID:</strong> ${user.id}</p>
-    <p style="margin: 0 0 8px; color: #333;"><strong>Username:</strong> ${user.username}</p>
-    <p style="margin: 0 0 8px; color: #333;"><strong>Email:</strong> ${user.email ?? "Not set"}</p>
-    <p style="margin: 0 0 8px; color: #333;"><strong>Request Type:</strong> ${requestType}</p>
-    <p style="margin: 0 0 8px; color: #333;"><strong>Jurisdiction:</strong> ${jurisdiction}</p>
+    <p style="margin: 0 0 8px; color: #333;"><strong>User ID:</strong> ${escapeHtml(String(user.id))}</p>
+    <p style="margin: 0 0 8px; color: #333;"><strong>Username:</strong> ${escapeHtml(user.username)}</p>
+    <p style="margin: 0 0 8px; color: #333;"><strong>Email:</strong> ${escapeHtml(user.email ?? "Not set")}</p>
+    <p style="margin: 0 0 8px; color: #333;"><strong>Request Type:</strong> ${escapeHtml(requestType)}</p>
+    <p style="margin: 0 0 8px; color: #333;"><strong>Jurisdiction:</strong> ${escapeHtml(jurisdiction)}</p>
     <p style="margin: 0 0 8px; color: #333;"><strong>Details:</strong></p>
-    <pre style="white-space: pre-wrap; background: #f8fafc; padding: 12px; border-radius: 8px; margin: 0;">${details}</pre>
+    <pre style="white-space: pre-wrap; background: #f8fafc; padding: 12px; border-radius: 8px; margin: 0;">${escapeHtml(details)}</pre>
   </div>
 </body>
 </html>`;