Correctly escape user-defined names in emails

Closes #1151 Signed-off-by: Thomas Citharel <tcit@tcit.fr>
2022-10-31 13:00:45 +01:00
parent 695d773d50
commit 470a3e594b
28 changed files with 162 additions and 118 deletions
--- a/lib/service/metadata/utils.ex
+++ b/lib/service/metadata/utils.ex
@@ -74,4 +74,11 @@ defmodule Mobilizon.Service.Metadata.Utils do

  @spec stringify_tag(String.t(), String.t()) :: String.t()
  defp stringify_tag(tag, acc) when is_binary(tag), do: acc <> tag
+
+  @spec escape_text(String.t()) :: String.t()
+  def escape_text(text) do
+    text
+    |> HTML.html_escape()
+    |> HTML.safe_to_string()
+  end
 end