From 4b828bf34e9c8f1d644078b5ba9594084b634159 Mon Sep 17 00:00:00 2001
From: Dave Earley <dave@hi.events>
Date: Tue, 17 Mar 2026 09:09:33 +0000
Subject: [PATCH] fix: Sanitize email template body with HTMLPurifier

Closes #1073
---
 .../Handlers/EmailTemplate/CreateEmailTemplateHandler.php   | 4 +++-
 .../Handlers/EmailTemplate/UpdateEmailTemplateHandler.php   | 6 ++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/backend/app/Services/Application/Handlers/EmailTemplate/CreateEmailTemplateHandler.php b/backend/app/Services/Application/Handlers/EmailTemplate/CreateEmailTemplateHandler.php
index afc93bb3b1..478df4e2cf 100644
--- a/backend/app/Services/Application/Handlers/EmailTemplate/CreateEmailTemplateHandler.php
+++ b/backend/app/Services/Application/Handlers/EmailTemplate/CreateEmailTemplateHandler.php
@@ -8,12 +8,14 @@
 use HiEvents\Repository\Interfaces\EmailTemplateRepositoryInterface;
 use HiEvents\Services\Application\Handlers\EmailTemplate\DTO\UpsertEmailTemplateDTO;
 use HiEvents\Services\Domain\Email\EmailTemplateService;
+use HiEvents\Services\Infrastructure\HtmlPurifier\HtmlPurifierService;
 
 class CreateEmailTemplateHandler
 {
     public function __construct(
         private readonly EmailTemplateRepositoryInterface $emailTemplateRepository,
         private readonly EmailTemplateService             $emailTemplateService,
+        private readonly HtmlPurifierService              $purifier,
     )
     {
     }
@@ -50,7 +52,7 @@ public function handle(UpsertEmailTemplateDTO $dto): EmailTemplateDomainObject
             'event_id' => $dto->event_id,
             'template_type' => $dto->template_type->value,
             'subject' => $dto->subject,
-            'body' => $dto->body,
+            'body' => $this->purifier->purify($dto->body),
             'cta' => $dto->cta,
             'engine' => $dto->engine->value,
             'is_active' => $dto->is_active,
diff --git a/backend/app/Services/Application/Handlers/EmailTemplate/UpdateEmailTemplateHandler.php b/backend/app/Services/Application/Handlers/EmailTemplate/UpdateEmailTemplateHandler.php
index b26f25b1a9..ceb110a7e9 100644
--- a/backend/app/Services/Application/Handlers/EmailTemplate/UpdateEmailTemplateHandler.php
+++ b/backend/app/Services/Application/Handlers/EmailTemplate/UpdateEmailTemplateHandler.php
@@ -9,12 +9,14 @@
 use HiEvents\Repository\Interfaces\EmailTemplateRepositoryInterface;
 use HiEvents\Services\Application\Handlers\EmailTemplate\DTO\UpsertEmailTemplateDTO;
 use HiEvents\Services\Domain\Email\EmailTemplateService;
+use HiEvents\Services\Infrastructure\HtmlPurifier\HtmlPurifierService;
 
 class UpdateEmailTemplateHandler
 {
     public function __construct(
         private readonly EmailTemplateRepositoryInterface $emailTemplateRepository,
-        private readonly EmailTemplateService $emailTemplateService
+        private readonly EmailTemplateService $emailTemplateService,
+        private readonly HtmlPurifierService $purifier,
     ) {
     }
 
@@ -47,7 +49,7 @@ public function handle(UpsertEmailTemplateDTO $dto): EmailTemplateDomainObject
 
         return $this->emailTemplateRepository->updateFromArray($template->getId(), [
             'subject' => $dto->subject,
-            'body' => $dto->body,
+            'body' => $this->purifier->purify($dto->body),
             'cta' => $dto->cta,
             'engine' => $dto->engine->value,
             'is_active' => $dto->is_active,