Open stefaanMLB opened 4 years ago
We don't URL encode the subject directly in this project (but perhaps the email dependency does). We do use mustache.render
for templates which I believe will modify content to remove XSS attacks. Did you have an example?
Counter increment (20000) for "orderNumberElectronic" is too large
is turned into
Counter increment (20000) for "orderNumberElectronic" is too large
OK, URL encoded would be something like this which seems unlikely:
Counter%20increment%20(20000)%20for%20%22orderNumberElectronic%22%20is%20too%20large
In testing Mustache directly, I'm not seeing that either:
Mustache.render(`Counter increment (20000) for "orderNumberElectronic" is too large`)
// --> "Counter increment (20000) for \"orderNumberElectronic\" is too large"
Maybe something specific to our SMTP server, I'll check with the operations guys
It seems the subject field is url-encoded. Is there a way to disable that ? Setting the
html
option to false doesn't help.