fix(reminders): escape task titles in grouped email HTML bodies (OUT-3861)

Task titles are user-controlled and were interpolated verbatim into the
htmlBody of grouped emails. Escape them via a shared escapeHtml util to
prevent markup injection in the rendered email.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: priosshrsth

src/app/api/notification/groupedEmail.renderer.test.ts

@@ -109,4 +109,14 @@ describe('renderGroupedEmail', () => {
   it('returns an empty body when there are no sections', () => {
     expect(renderGroupedEmail({ totalEventCount: 0, sections: [] }).htmlBody).toBe('')
   })
+
+  it('escapes HTML in task names to prevent markup injection', () => {
+    const email = renderGroupedEmail({
+      totalEventCount: 1,
+      sections: [section({ taskNames: [`</li><img src=x onerror="alert(1)">`] })],
+    })
+
+    expect(email.htmlBody).not.toContain('<img')
+    expect(email.htmlBody).toContain('&lt;/li&gt;&lt;img src=x onerror=&quot;alert(1)&quot;&gt;')
+  })
 })

src/app/api/notification/groupedEmail.renderer.ts

@@ -1,4 +1,5 @@
 import { GroupedEmailEventType } from '@prisma/client'
+import { escapeHtml } from '@/utils/escapeHtml'
 import { GroupedEmailContent, GroupedEmailSection } from './groupedEmail.composer'
 
 export const GROUPED_EMAIL_HEADER = 'Catch up on task activity'
@@ -22,7 +23,7 @@ const sectionHeading: Record<GroupedEmailEventType, (count: number) => string> =
 }
 
 const renderSection = (section: GroupedEmailSection): string => {
-  const items = section.taskNames.map((name) => `<li>'${name}'</li>`).join('')
+  const items = section.taskNames.map((name) => `<li>'${escapeHtml(name)}'</li>`).join('')
   const overflow =
     section.overflowCount > 0
       ? `<em>+${section.overflowCount} other ${pluralize(section.overflowCount, 'task', 'tasks')}</em>`

src/app/api/notification/groupedReminderEmail.renderer.test.ts

@@ -48,4 +48,12 @@ describe('renderGroupedReminderEmail', () => {
     ])
     expect(result.htmlBody).toContain(expectedLabel)
   })
+
+  it('escapes HTML in task titles to prevent markup injection', () => {
+    const result = renderGroupedReminderEmail([
+      { taskTitle: `</li><img src=x onerror="alert(1)">`, reminderType: TaskReminderType.DUE_DATE_TODAY },
+    ])
+    expect(result.htmlBody).not.toContain('<img')
+    expect(result.htmlBody).toContain('&lt;/li&gt;&lt;img src=x onerror=&quot;alert(1)&quot;&gt;')
+  })
 })

src/app/api/notification/groupedReminderEmail.renderer.ts

@@ -1,4 +1,5 @@
 import { TaskReminderType } from '@prisma/client'
+import { escapeHtml } from '@/utils/escapeHtml'
 
 export type ReminderEntry = {
   taskTitle: string
@@ -23,7 +24,9 @@ const reminderLabel: Record<TaskReminderType, string> = {
 
 export const renderGroupedReminderEmail = (entries: ReminderEntry[]): GroupedReminderEmailDetails => {
   const n = entries.length
-  const items = entries.map((e) => `<li>'${e.taskTitle}' – <em>${reminderLabel[e.reminderType]}</em></li>`).join('')
+  const items = entries
+    .map((e) => `<li>'${escapeHtml(e.taskTitle)}' – <em>${reminderLabel[e.reminderType]}</em></li>`)
+    .join('')
   return {
     subject: `[Reminder] You have ${n} ${n === 1 ? 'task' : 'tasks'} to complete`,
     header: 'Task reminders',

src/utils/escapeHtml.ts

@@ -0,0 +1,2 @@
+export const escapeHtml = (value: string): string =>
+  value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;')