Correctly escape user-defined names in emails

Closes #1151 Signed-off-by: Thomas Citharel <tcit@tcit.fr>
2022-10-31 13:00:45 +01:00
parent 695d773d50
commit 470a3e594b
28 changed files with 162 additions and 118 deletions
--- a/lib/web/templates/email/activity/_comment_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_comment_activity_item.html.heex
@@ -1,35 +1,35 @@
 <%= case @activity.subject do %>
  <% :event_comment_mention -> %>
    <%= dgettext("activity", "%{profile} mentionned you in a comment under event %{event}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      event:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :event,
        @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                        </a>"
    })
    |> raw %>
  <% :participation_event_comment -> %>
    <%= dgettext("activity", "%{profile} has posted an announcement under event %{event}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      event:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :event,
        @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                        </a>"
    })
    |> raw %>
  <% :event_new_comment -> %>
    <%= if @activity.subject_params["comment_reply_to"] do %>
      <%= dgettext("activity", "%{profile} has posted a new reply under your event %{event}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        event:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :event,
          @activity.subject_params["event_uuid"]) |> URI.decode()}#comment-#{@activity.subject_params["comment_reply_to_uuid"]}-#{@activity.subject_params["comment_uuid"]}\">
-                                #{@activity.subject_params["event_title"]}
+                                #{escape_html(@activity.subject_params["event_title"])}
                            </a>"
      })
      |> raw %>
@@ -38,12 +38,12 @@
        "activity",
        "%{profile} has posted a new comment under your event %{event}.",
        %{
-          profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+          profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
          event:
            "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
            :event,
            @activity.subject_params["event_uuid"]) |> URI.decode()}#comment-#{@activity.subject_params["comment_uuid"]}\">
-                                #{@activity.subject_params["event_title"]}
+                                #{escape_html(@activity.subject_params["event_title"])}
                            </a>"
        }
      )
--- a/lib/web/templates/email/activity/_discussion_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_discussion_activity_item.html.heex
@@ -1,40 +1,40 @@
 <%= case @activity.subject do %>
  <% :discussion_created -> %>
    <%= dgettext("activity", "%{profile} created the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      discussion:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
    })
    |> raw %>
  <% :discussion_replied -> %>
    <%= dgettext("activity", "%{profile} replied to the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      discussion:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
    })
    |> raw %>
  <% :discussion_renamed -> %>
    <%= dgettext("activity", "%{profile} renamed the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      discussion:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
    })
    |> raw %>
  <% :discussion_archived -> %>
    <%= dgettext("activity", "%{profile} archived the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      discussion:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
    })
    |> raw %>
  <% :discussion_deleted -> %>
    <%= dgettext("activity", "%{profile} deleted the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-      discussion: "<b>#{@activity.subject_params["discussion_title"]}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+      discussion: "<b>#{escape_html(@activity.subject_params["discussion_title"])}</b>"
    })
    |> raw %>
 <% end %>
--- a/lib/web/templates/email/activity/_event_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_event_activity_item.html.heex
@@ -1,52 +1,52 @@
 <%= case @activity.subject do %>
  <% :event_created -> %>
    <%= dgettext("activity", "The event %{event} was created by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      event:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :event,
        @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                        </a>"
    })
    |> raw %>
  <% :event_updated -> %>
    <%= dgettext("activity", "The event %{event} was updated by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      event:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :event,
        @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                        </a>"
    })
    |> raw %>
  <% :event_deleted -> %>
    <%= dgettext("activity", "The event %{event} was deleted by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-      event: "<b>#{@activity.subject_params["event_title"]}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+      event: "<b>#{escape_html(@activity.subject_params["event_title"])}</b>"
    })
    |> raw %>
  <% :comment_posted -> %>
    <%= if @activity.subject_params["comment_reply_to"] do %>
      <%= dgettext("activity", "%{profile} replied to a comment on the event %{event}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        event:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :event,
          @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                        </a>"
      })
      |> raw %>
    <% else %>
      <%= dgettext("activity", "%{profile} posted a comment on the event %{event}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        event:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :event,
          @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                        </a>"
      })
      |> raw %>
--- a/lib/web/templates/email/activity/_group_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_group_activity_item.html.heex
@@ -1,23 +1,23 @@
 <%= case @activity.subject do %>
  <% :group_created -> %>
    <%= dgettext("activity", "%{profile} created the group %{group}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      group:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :actor,
        @activity.subject_params["group_federated_username"]) |> URI.decode()}\">
-                            #{@activity.subject_params["group_name"]}
+                            #{escape_html(@activity.subject_params["group_name"])}
                        </a>"
    })
    |> raw %>
  <% :group_updated -> %>
    <%= dgettext("activity", "%{profile} updated the group %{group}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      group:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :actor,
        @activity.subject_params["group_federated_username"]) |> URI.decode()}\">
-                            #{@activity.subject_params["group_name"]}
+                            #{escape_html(@activity.subject_params["group_name"])}
                        </a>"
    })
    |> raw %>
--- a/lib/web/templates/email/activity/_member_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_member_activity_item.html.heex
@@ -1,58 +1,58 @@
 <%= case @activity.subject do %>
  <% :member_request -> %>
    <%= dgettext("activity", "%{member} requested to join the group.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
    })
    |> raw %>
  <% :member_invited -> %>
    <%= dgettext("activity", "%{member} was invited by %{profile}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
    })
    |> raw %>
  <% :member_accepted_invitation -> %>
    <%= dgettext("activity", "%{member} accepted the invitation to join the group.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
    })
    |> raw %>
  <% :member_rejected_invitation -> %>
    <%= dgettext("activity", "%{member} rejected the invitation to join the group.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
    })
    |> raw %>
  <% :member_joined -> %>
    <%= dgettext("activity", "%{member} joined the group.", %{
      member:
-        "<b title=\"#{@activity.subject_params["member_actor_federated_username"]}\">#{@activity.subject_params["member_actor_name"]}</b>"
+        "<b title=\"#{@activity.subject_params["member_actor_federated_username"]}\">#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
    })
    |> raw %>
  <% :member_added -> %>
    <%= dgettext("activity", "%{profile} added the member %{member}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
    })
    |> raw %>
  <% :member_approved -> %>
    <%= dgettext("activity", "%{profile} approved the member %{member}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
    })
    |> raw %>
  <% :member_updated -> %>
    <%= dgettext("activity", "%{profile} updated the member %{member}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
    })
    |> raw %>
  <% :member_removed -> %>
    <%= dgettext("activity", "%{profile} excluded member %{member}.", %{
      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
    })
    |> raw %>
  <% :member_quit -> %>
    <%= dgettext("activity", "%{profile} quit the group.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
    })
    |> raw %>
 <% end %>
--- a/lib/web/templates/email/activity/_post_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_post_activity_item.html.heex
@@ -1,30 +1,30 @@
 <%= case @activity.subject do %>
  <% :post_created -> %>
    <%= dgettext("activity", "The post %{post} was created by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      post:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :post,
        @activity.subject_params["post_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["post_title"]}
+                            #{escape_html(@activity.subject_params["post_title"])}
                        </a>"
    })
    |> raw %>
  <% :post_updated -> %>
    <%= dgettext("activity", "The post %{post} was updated by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
      post:
        "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
        :post,
        @activity.subject_params["post_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["post_title"]}
+                            #{escape_html(@activity.subject_params["post_title"])}
                        </a>"
    })
    |> raw %>
  <% :post_deleted -> %>
    <%= dgettext("activity", "The post %{post} was deleted by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-      post: "<b>#{@activity.subject_params["post_title"]}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+      post: "<b>#{escape_html(@activity.subject_params["post_title"])}</b>"
    })
    |> raw %>
 <% end %>
--- a/lib/web/templates/email/activity/_resource_activity_item.html.heex
+++ b/lib/web/templates/email/activity/_resource_activity_item.html.heex
@@ -2,23 +2,23 @@
  <% :resource_created -> %>
    <%= if @activity.subject_params["is_folder"] do %>
      <%= dgettext("activity", "%{profile} created the folder %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        resource:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :resource,
          @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                            </a>"
      })
      |> raw %>
    <% else %>
      <%= dgettext("activity", "%{profile} created the resource %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        resource:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :resource,
          @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                            </a>"
      })
      |> raw %>
@@ -29,14 +29,15 @@
        "activity",
        "%{profile} renamed the folder from %{old_resource_title} to %{resource}.",
        %{
-          profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+          profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
          resource:
            "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
            :resource,
            @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                            </a>",
-          old_resource_title: "<b>#{@activity.subject_params["old_resource_title"]}</b>"
+          old_resource_title:
+            "<b>#{escape_html(@activity.subject_params["old_resource_title"])}</b>"
        }
      )
      |> raw %>
@@ -45,14 +46,15 @@
        "activity",
        "%{profile} renamed the resource from %{old_resource_title} to %{resource}.",
        %{
-          profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+          profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
          resource:
            "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
            :resource,
            @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                            </a>",
-          old_resource_title: "<b>#{@activity.subject_params["old_resource_title"]}</b>"
+          old_resource_title:
+            "<b>#{escape_html(@activity.subject_params["old_resource_title"])}</b>"
        }
      )
      |> raw %>
@@ -60,23 +62,23 @@
  <% :resource_moved -> %>
    <%= if @activity.subject_params["is_folder"] do %>
      <%= dgettext("activity", "%{profile} moved the folder %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        resource:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :resource,
          @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                            </a>"
      })
      |> raw %>
    <% else %>
      <%= dgettext("activity", "%{profile} moved the resource %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
        resource:
          "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
          :resource,
          @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                            </a>"
      })
      |> raw %>
@@ -84,14 +86,14 @@
  <% :resource_deleted -> %>
    <%= if @activity.subject_params["is_folder"] do %>
      <%= dgettext("activity", "%{profile} deleted the folder %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-        resource: "<b>#{@activity.subject_params["resource_title"]}</b>"
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+        resource: "<b>#{escape_html(@activity.subject_params["resource_title"])}</b>"
      })
      |> raw %>
    <% else %>
      <%= dgettext("activity", "%{profile} deleted the resource %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-        resource: "<b>#{@activity.subject_params["resource_title"]}</b>"
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+        resource: "<b>#{escape_html(@activity.subject_params["resource_title"])}</b>"
      })
      |> raw %>
    <% end %>
--- a/lib/web/templates/email/anonymous_participation_confirmation.html.heex
+++ b/lib/web/templates/email/anonymous_participation_confirmation.html.heex
@@ -46,7 +46,7 @@
          <p style="margin: 0;">
            <%= gettext(
              "Hi there! You just registered to join this event: « <b>%{title}</b> ». Please confirm the e-mail address you provided:",
-              title: @participant.event.title
+              title: escape_html(@participant.event.title)
            )
            |> raw %>
          </p>
--- a/lib/web/templates/email/email.html.heex
+++ b/lib/web/templates/email/email.html.heex
@@ -109,7 +109,7 @@
                    <%= gettext("This is a demonstration site to test Mobilizon.") %>
                  </p>
                  <p style="margin: 0; color: #3A384C;">
-                    <%= gettext("<b>Please do not use it for real purposes.</b>") |> raw() %>
+                    <b><%= gettext("Please do not use it for real purposes.") %></b>
                  </p>
                </td>
              </tr>
--- a/lib/web/templates/email/email_anonymous_activity.html.heex
+++ b/lib/web/templates/email/email_anonymous_activity.html.heex
@@ -49,13 +49,12 @@
                  "activity",
                  "%{profile} has posted an announcement under event %{event}.",
                  %{
-                    profile:
-                      "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+                    profile: "<b>#{escape_html(display_name_and_username(@activity.author))}</b>",
                    event:
                      "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
                      :event,
                      @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["event_title"]}
+                                #{escape_html(@activity.subject_params["event_title"])}
                            </a>"
                  }
                )
--- a/lib/web/templates/email/event_participation_approved.html.heex
+++ b/lib/web/templates/email/event_participation_approved.html.heex
@@ -44,7 +44,9 @@
          style="padding: 20px 30px 0px 30px; color: #474467; font-family: 'Roboto', Helvetica, Arial, sans-serif; font-size: 18px; font-weight: 400; line-height: 25px;"
        >
          <p style="margin: 0;">
-            <%= gettext("You recently requested to attend <b>%{title}</b>.", title: @event.title)
+            <%= gettext("You recently requested to attend <b>%{title}</b>.",
+              title: escape_html(@event.title)
+            )
            |> raw %>
          </p>
        </td>
--- a/lib/web/templates/email/event_participation_confirmed.html.heex
+++ b/lib/web/templates/email/event_participation_confirmed.html.heex
@@ -44,7 +44,9 @@
          style="padding: 20px 30px 0px 30px; color: #474467; font-family: 'Roboto', Helvetica, Arial, sans-serif; font-size: 18px; font-weight: 400; line-height: 25px;"
        >
          <p style="margin: 0;">
-            <%= gettext("You recently requested to attend <b>%{title}</b>.", title: @event.title)
+            <%= gettext("You recently requested to attend <b>%{title}</b>.",
+              title: escape_html(@event.title)
+            )
            |> raw %>
          </p>
        </td>
--- a/lib/web/templates/email/event_participation_rejected.html.heex
+++ b/lib/web/templates/email/event_participation_rejected.html.heex
@@ -44,7 +44,9 @@
          style="padding: 20px 30px 0px 30px; color: #474467; font-family: 'Roboto', Helvetica, Arial, sans-serif; font-size: 18px; font-weight: 400; line-height: 25px;"
        >
          <p style="margin: 0;">
-            <%= gettext("You issued a request to attend <b>%{title}</b>.", title: @event.title)
+            <%= gettext("You issued a request to attend <b>%{title}</b>.",
+              title: escape_html(@event.title)
+            )
            |> raw %>
          </p>
        </td>
--- a/lib/web/templates/email/event_updated.html.heex
+++ b/lib/web/templates/email/event_updated.html.heex
@@ -46,7 +46,7 @@
          <p style="margin: 0;">
            <%= gettext(
              "There have been changes for <b>%{title}</b> so we'd thought we'd let you know.",
-              title: @old_event.title
+              title: escape_html(@old_event.title)
            )
            |> raw %>
          </p>
--- a/lib/web/templates/email/group_invite.html.heex
+++ b/lib/web/templates/email/group_invite.html.heex
@@ -46,8 +46,8 @@
          <p style="margin: 0;">
            <%= gettext(
              "<b>%{inviter}</b> just invited you to join their group %{link_start}<b>%{group}</b>%{link_end}",
-              group: @group.name,
-              inviter: @inviter.name,
+              group: escape_html(display_name(@group)),
+              inviter: escape_html(display_name(@inviter)),
              link_start: "<a href=\"#{@group.url}\">",
              link_end: "</a>"
            )
--- a/lib/web/templates/email/group_member_removal.html.heex
+++ b/lib/web/templates/email/group_member_removal.html.heex
@@ -46,7 +46,7 @@
          <p style="margin: 0;">
            <%= gettext(
              "You have been removed from group %{link_start}<b>%{group}</b>%{link_end}. You will not be able to access this group's private content anymore.",
-              group: @group.name,
+              group: escape_html(display_name(@group)),
              link_start: "<a href=\"#{@group.url}\">",
              link_end: "</a>"
            )
--- a/lib/web/templates/email/group_membership_approval.html.heex
+++ b/lib/web/templates/email/group_membership_approval.html.heex
@@ -46,9 +46,9 @@
          <p style="margin: 0;">
            <%= gettext(
              "Your membership request for group %{link_start}<b>%{group}</b>%{link_end} has been approved.",
-              group: Mobilizon.Actors.Actor.display_name(@group),
+              group: escape_html(display_name(@group)),
              link_start:
-                "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, Mobilizon.Actors.Actor.preferred_username_and_domain(@group)) |> URI.decode()}\">",
+                "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, preferred_username_and_domain(@group)) |> URI.decode()}\">",
              link_end: "</a>"
            )
            |> raw %>
--- a/lib/web/templates/email/group_membership_rejection.html.heex
+++ b/lib/web/templates/email/group_membership_rejection.html.heex
@@ -46,9 +46,9 @@
          <p style="margin: 0;">
            <%= gettext(
              "Your membership request for group %{link_start}<b>%{group}</b>%{link_end} has been rejected.",
-              group: Mobilizon.Actors.Actor.display_name(@group),
+              group: escape_html(display_name(@group)),
              link_start:
-                "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, Mobilizon.Actors.Actor.preferred_username_and_domain(@group)) |> URI.decode()}\">",
+                "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, preferred_username_and_domain(@group)) |> URI.decode()}\">",
              link_end: "</a>"
            )
            |> raw %>
--- a/lib/web/templates/email/group_suspension.html.heex
+++ b/lib/web/templates/email/group_suspension.html.heex
@@ -16,7 +16,7 @@
        >
          <h1 style="font-size: 48px; font-weight: 400; margin: 0;">
            <%= gettext("The group %{group} has been suspended on %{instance}!",
-              group: @group.name || @group.preferred_username,
+              group: display_name(@group),
              instance: @instance_name
            ) %>
          </h1>
@@ -49,12 +49,8 @@
          <p style="margin: 0;">
            <%= gettext(
              "Your instance's moderation team has decided to suspend <b>%{group_name}</b> (%{group_address}). You are no longer a member of this group.",
-              group_name: @group.name,
-              group_address:
-                if(@group.domain,
-                  do: "@#{@group.preferred_username}@#{@group.domain}",
-                  else: "@#{@group.preferred_username}"
-                )
+              group_name: escape_html(display_name(@group)),
+              group_address: preferred_username_and_domain(@group)
            )
            |> raw %>
          </p>
--- a/lib/web/templates/email/instance_follow.html.heex
+++ b/lib/web/templates/email/instance_follow.html.heex
@@ -45,7 +45,7 @@
        >
          <p style="margin: 0;">
            <%= gettext("<b>%{name}</b> just requested to follow your instance.",
-              name: Mobilizon.Actors.Actor.display_name_and_username(@follower)
+              name: escape_html(display_name_and_username(@follower))
            )
            |> raw %>
            <br />
@@ -67,7 +67,7 @@
            <p style="margin: 0;">
              <%= gettext(
                "Note: %{name} following you doesn't necessarily imply that you follow this instance, but you can ask to follow them too.",
-                name: Mobilizon.Actors.Actor.display_name_and_username(@follower)
+                name: escape_html(display_name_and_username(@follower))
              ) %>
            </p>
          </td>
--- a/lib/web/templates/email/report.html.heex
+++ b/lib/web/templates/email/report.html.heex
@@ -47,12 +47,12 @@
            <%= if @report.reporter.type == :Application and @report.reporter.preferred_username == "relay" do %>
              <%= gettext(
                "Someone on <b>%{instance}</b> reported the following content for you to analyze:",
-                instance: @report.reporter.domain
+                instance: escape_html(@report.reporter.domain)
              )
              |> raw %>
            <% else %>
              <%= gettext("<b>%{reporter}</b> reported the following content.",
-                reporter: Mobilizon.Actors.Actor.display_name_and_username(@report.reporter)
+                reporter: escape_html(display_name_and_username(@report.reporter))
              )
              |> raw %>
            <% end %>
--- a/lib/web/views/email_view.ex
+++ b/lib/web/views/email_view.ex
@@ -4,12 +4,13 @@ defmodule Mobilizon.Web.EmailView do
    pattern: "**/*",
    namespace: Mobilizon.Web

+  alias Mobilizon.Actors.Actor
  alias Mobilizon.Service.Address
  alias Mobilizon.Service.DateTime, as: DateTimeRenderer
  alias Mobilizon.Web.Router.Helpers, as: Routes
  import Mobilizon.Web.Gettext
  import Mobilizon.Service.Metadata.Utils, only: [process_description: 1]
-  import Phoenix.HTML, only: [raw: 1]
+  import Phoenix.HTML, only: [raw: 1, html_escape: 1, safe_to_string: 1]

  defdelegate datetime_to_string(datetime, locale \\ "en", format \\ :medium),
    to: DateTimeRenderer
@@ -24,4 +25,20 @@ defmodule Mobilizon.Web.EmailView do
  defdelegate datetime_relative(datetime, locale \\ "en"), to: DateTimeRenderer
  defdelegate render_address(address), to: Address
  defdelegate is_same_day?(one, two), to: DateTimeRenderer
+  defdelegate display_name_and_username(actor), to: Actor
+  defdelegate display_name(actor), to: Actor
+  defdelegate preferred_username_and_domain(actor), to: Actor
+
+  @spec escape_html(String.t()) :: String.t()
+  def escape_html(string) do
+    string
+    |> html_escape()
+    |> safe_to_string()
+  end
+
+  def escaped_display_name_and_username(actor) do
+    actor
+    |> Actor.display_name_and_username()
+    |> escape_html()
+  end
 end