fix(shared): properly unescape button templates (#4852)

apps/api/e2e/compile-email-template.e2e.ts

@@ -216,4 +216,160 @@ describe('Compile E-mail Template', function () {
       expect(subject).to.equal('A title for Header Test');
     });
   });
+
+  describe('Escaping', function () {
+    it('should escape editor text in double curly braces', async function () {
+      const { html } = await useCase.execute(
+        CompileEmailTemplateCommand.create({
+          organizationId: session.organization._id,
+          environmentId: session.environment._id,
+          layoutId: null,
+          preheader: null,
+          content: [
+            {
+              type: EmailBlockTypeEnum.TEXT,
+              content: '<div>{{textUrl}}</div>',
+            },
+          ],
+          payload: {
+            textUrl: 'https://[email protected]',
+          },
+          userId: session.user._id,
+          contentType: 'editor',
+          subject: 'Editor Text Escape Test',
+        })
+      );
+
+      expect(html).to.contain('<div>https://example.com?email&#x3D;[email protected]</div>');
+    });
+
+    it('should not escape editor text in triple curly braces', async function () {
+      const { html } = await useCase.execute(
+        CompileEmailTemplateCommand.create({
+          organizationId: session.organization._id,
+          environmentId: session.environment._id,
+          layoutId: null,
+          preheader: null,
+          content: [
+            {
+              type: EmailBlockTypeEnum.TEXT,
+              content: '<div>{{{textUrl}}}</div>',
+            },
+          ],
+          payload: {
+            textUrl: 'https://[email protected]',
+          },
+          userId: session.user._id,
+          contentType: 'editor',
+          subject: 'Editor Text No Escape Test',
+        })
+      );
+
+      expect(html).to.contain('<div>https://[email protected]</div>');
+    });
+
+    it('should escape button text in double curly braces', async function () {
+      const { html } = await useCase.execute(
+        CompileEmailTemplateCommand.create({
+          organizationId: session.organization._id,
+          environmentId: session.environment._id,
+          layoutId: null,
+          preheader: null,
+          content: [
+            {
+              type: EmailBlockTypeEnum.BUTTON,
+              content: '{{buttonText}}',
+              url: 'https://example.com',
+            },
+          ],
+          payload: {
+            buttonText: 'https://[email protected]',
+          },
+          userId: session.user._id,
+          contentType: 'editor',
+          subject: 'Editor Button Escape Test',
+        })
+      );
+
+      expect(html).to.contain('https://example.com?email&#x3D;[email protected]');
+    });
+
+    it('should not escape button text in triple curly braces', async function () {
+      const { html } = await useCase.execute(
+        CompileEmailTemplateCommand.create({
+          organizationId: session.organization._id,
+          environmentId: session.environment._id,
+          layoutId: null,
+          preheader: null,
+          content: [
+            {
+              type: EmailBlockTypeEnum.BUTTON,
+              content: '{{{buttonText}}}',
+              url: 'https://example.com',
+            },
+          ],
+          payload: {
+            buttonText: 'https://[email protected]',
+          },
+          userId: session.user._id,
+          contentType: 'editor',
+          subject: 'Editor Button Escape Test',
+        })
+      );
+
+      expect(html).to.contain('https://[email protected]');
+    });
+
+    it('should escape button url in double curly braces', async function () {
+      const { html } = await useCase.execute(
+        CompileEmailTemplateCommand.create({
+          organizationId: session.organization._id,
+          environmentId: session.environment._id,
+          layoutId: null,
+          preheader: null,
+          content: [
+            {
+              type: EmailBlockTypeEnum.BUTTON,
+              content: 'Click Here To Go To Link!',
+              url: '{{buttonUrl}}',
+            },
+          ],
+          payload: {
+            buttonUrl: 'https://[email protected]',
+          },
+          userId: session.user._id,
+          contentType: 'editor',
+          subject: 'Editor Button Escape Test',
+        })
+      );
+
+      expect(html).to.contain('https://example.com?email&#x3D;[email protected]');
+    });
+
+    it('should not escape button url in triple curly braces', async function () {
+      const { html } = await useCase.execute(
+        CompileEmailTemplateCommand.create({
+          organizationId: session.organization._id,
+          environmentId: session.environment._id,
+          layoutId: null,
+          preheader: null,
+          content: [
+            {
+              type: EmailBlockTypeEnum.BUTTON,
+              content: 'Click Here To Go To Link!',
+              url: '{{{buttonUrl}}}',
+            },
+          ],
+          payload: {
+            buttonUrl: 'https://[email protected]',
+          },
+          userId: session.user._id,
+          contentType: 'editor',
+          subject: 'Editor Button No Escape Test',
+        })
+      );
+
+      expect(html).to.contain('https://[email protected]');
+    });
+  });
 });

packages/application-generic/src/usecases/compile-email-template/templates/basic.handlebars

@@ -35,9 +35,9 @@
             border-color: {{#if ../branding.color}}{{../branding.color}}{{else}}#ff6f61{{/if}};
             text-decoration: none;
             "
-             href="{{url}}"
+             href="{{{url}}}"
              target="_blank">
-            {{content}}
+            {{{content}}}
           </a>
         </div>
       </div>