fix: TestValidateConfig, email content injection issue

Author: mgukov

pkg/task_logger/task_logger.go

@@ -2,7 +2,6 @@ package task_logger
 
 import (
 	"os/exec"
-	"strings"
 	"time"
 )
 
@@ -53,9 +52,11 @@ func (s TaskStatus) Format() (res string) {
 		res += "⏹️"
 	case TaskWaitingConfirmation:
 		res += "⚠️"
+	default:
+		res += "❓"
 	}
-	res += strings.ToUpper(string(s))
-
+	// to avoid email content injection issue
+	//res += strings.ToUpper(string(s))
 	return
 }
 

services/tasks/alert.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"embed"
 	"fmt"
-	"html"
 	"net/http"
 	"strconv"
 	"text/template"
@@ -48,15 +47,15 @@ func (t *TaskRunner) sendMailAlert() {
 	author, version := t.alertInfos()
 
 	alert := Alert{
-		Name:   html.EscapeString(t.Template.Name),
+		Name:   t.Template.Name,
 		Author: author,
 		Color:  t.alertColor("email"),
 		Task: alertTask{
 			ID:      strconv.Itoa(t.Task.ID),
 			URL:     t.taskLink(),
-			Result:  html.EscapeString(t.Task.Status.Format()),
+			Result:  t.Task.Status.Format(),
 			Version: version,
-			Desc:    html.EscapeString(t.Task.Message),
+			Desc:    t.Task.Message,
 		},
 	}
 
@@ -100,7 +99,7 @@ func (t *TaskRunner) sendMailAlert() {
 			util.Config.EmailPassword,
 			util.Config.EmailSender,
 			user.Email,
-			fmt.Sprintf("Task '%s' failed", html.EscapeString(t.Template.Name)),
+			fmt.Sprintf("Task '%s' failed", t.Template.Name),
 			body.String(),
 		); err != nil {
 			util.LogError(err)

util/config_test.go

@@ -388,6 +388,7 @@ func TestValidateConfig(t *testing.T) {
 	var testDbDialect = DbDriverBolt
 	var testCookieHash = "0Sn+edH3doJ4EO4Rl49Y0KrxjUkXuVtR5zKHGGWerxQ="
 	var testMaxParallelTasks = 0
+	var testEmailTlsMinVersion = "1.2"
 
 	Config.Port = testPort
 	Config.Dialect = testDbDialect
@@ -396,6 +397,7 @@ func TestValidateConfig(t *testing.T) {
 	Config.GitClientId = GoGitClientId
 	Config.CookieEncryption = testCookieHash
 	Config.AccessKeyEncryption = testCookieHash
+	Config.EmailTlsMinVersion = testEmailTlsMinVersion
 	validateConfig()
 
 	Config.Port = "INVALID"