From 473f46bec4d1e35c3a435d37a0ac4abd1592566e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= Date: Tue, 22 Oct 2024 11:01:57 +0200 Subject: [PATCH] template.HTML is safe to use in this case G203 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörn Friedrich Dreyer --- services/notifications/pkg/email/email.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/services/notifications/pkg/email/email.go b/services/notifications/pkg/email/email.go index 7a3ff2051..e0d488e1f 100644 --- a/services/notifications/pkg/email/email.go +++ b/services/notifications/pkg/email/email.go @@ -67,11 +67,12 @@ func RenderEmailTemplate(mt MessageTemplate, locale, defaultLocale string, email }, nil } +// emailTemplate builds the email template. It does not use any user provided input, so it is safe to use template.HTML. func emailTemplate(tpl *template.Template, mt MessageTemplate) (string, error) { str, err := executeTemplate(tpl, map[string]interface{}{ - "Greeting": template.HTML(strings.TrimSpace(mt.Greeting)), - "MessageBody": template.HTML(strings.TrimSpace(mt.MessageBody)), - "CallToAction": template.HTML(strings.TrimSpace(mt.CallToAction)), + "Greeting": template.HTML(strings.TrimSpace(mt.Greeting)), // #nosec G203 + "MessageBody": template.HTML(strings.TrimSpace(mt.MessageBody)), // #nosec G203 + "CallToAction": template.HTML(strings.TrimSpace(mt.CallToAction)), // #nosec G203 }) if err != nil { return "", err