Skip to content

Fix HTML injection in email templates and harden server-side validation #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 3 commits into
base: main
Choose a base branch
from
+91 −20
Draft

Fix HTML injection in email templates and harden server-side validation #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8931e0e
Initial plan
Copilot Feb 21, 2026
dec09d7
Fix HTML injection (XSS) in email templates and add input validation
Copilot Feb 21, 2026
bbee637
Add email validation and trim whitespace in input validation
Copilot Feb 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 31 additions & 8 deletions netlify/functions/contact.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,15 @@ import nodemailer from 'nodemailer';
const rateLimitMap = new Map();
const RATE_LIMIT_WINDOW = 60000; // 1 minute

function escapeHtml(str) {
return String(str)
.replace(/&/g, '&')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#39;');
}

export async function handler(event) {
// Only allow POST
if (event.httpMethod !== 'POST') {
Expand Down Expand Up @@ -45,14 +54,28 @@ export async function handler(event) {
try {
const { name, email, subject, message } = JSON.parse(event.body);

if (!name || !email || !subject || !message) {
if (!name?.trim() || !email?.trim() || !subject?.trim() || !message?.trim()) {
return {
statusCode: 400,
headers,
body: JSON.stringify({ ok: false, error: 'All fields are required' }),
};
}

const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
if (!emailRegex.test(email)) {
return {
statusCode: 400,
headers,
body: JSON.stringify({ ok: false, error: 'Invalid email address' }),
};
}

const safeName = escapeHtml(name.trim());
const safeEmail = escapeHtml(email.trim());
const safeSubject = escapeHtml(subject.trim());
const safeMessage = escapeHtml(message.trim()).replace(/\n/g, '<br/>');

const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST,
port: +process.env.SMTP_PORT,
Expand All @@ -68,13 +91,13 @@ export async function handler(event) {
from: `Portfolio Contact <${process.env.SMTP_USER}>`,
to: process.env.RECIPIENT,
replyTo: email,
subject: `[Portfolio] ${subject} (from ${name})`,
subject: `[Portfolio] ${safeName} - ${safeSubject}`,
html: `
<h3>New message from your portfolio</h3>
<p><strong>Name:</strong> ${name}</p>
<p><strong>Email:</strong> ${email}</p>
<p><strong>Subject:</strong> ${subject}</p>
<p><strong>Message:</strong><br/>${message.replace(/\n/g, '<br/>')}</p>
<p><strong>Name:</strong> ${safeName}</p>
<p><strong>Email:</strong> ${safeEmail}</p>
<p><strong>Subject:</strong> ${safeSubject}</p>
<p><strong>Message:</strong><br/>${safeMessage}</p>
`,
});

Expand All @@ -87,13 +110,13 @@ export async function handler(event) {
<div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; color: #333;">
<h2 style="color: #3B82F6; border-bottom: 2px solid #3B82F6; padding-bottom: 10px;">Message Received</h2>

<p>Dear ${name},</p>
<p>Dear ${safeName},</p>

<p>Thank you for taking the time to reach out through my portfolio website. I have successfully received your message and truly appreciate your interest.</p>

<div style="background-color: #F3F4F6; border-left: 4px solid #3B82F6; padding: 15px; margin: 20px 0;">
<p style="margin: 0;"><strong>Your Message Details:</strong></p>
<p style="margin: 10px 0 0 0;"><strong>Subject:</strong> ${subject}</p>
<p style="margin: 10px 0 0 0;"><strong>Subject:</strong> ${safeSubject}</p>
</div>

<p>I make it a priority to respond to all inquiries promptly and will get back to you as soon as possible, typically within 24-48 hours.</p>
Expand Down
34 changes: 29 additions & 5 deletions project/server/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,15 @@ const app = express();
app.use(cors());
app.use(express.json());

function escapeHtml(str) {
return String(str)
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#39;');
}

const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST,
port: +process.env.SMTP_PORT,
Expand All @@ -21,21 +30,36 @@ const transporter = nodemailer.createTransport({

app.post('/api/contact', async (req, res) => {
const { name, email, subject, message } = req.body;

if (!name?.trim() || !email?.trim() || !subject?.trim() || !message?.trim()) {
return res.status(400).json({ ok: false, error: 'All fields are required' });
}

const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
if (!emailRegex.test(email)) {
return res.status(400).json({ ok: false, error: 'Invalid email address' });
}

const safeName = escapeHtml(name.trim());
const safeEmail = escapeHtml(email.trim());
const safeSubject = escapeHtml(subject.trim());
const safeMessage = escapeHtml(message.trim()).replace(/\n/g, '<br/>');

try {
await transporter.sendMail({
from: `Portfolio Contact <${process.env.SMTP_USER}>`,
to: process.env.RECIPIENT,
subject: `[Portfolio] ${subject} (from ${name})`,
subject: `[Portfolio] ${safeName} - ${safeSubject}`,
html: `
<p><strong>Name:</strong> ${name}</p>
<p><strong>Email:</strong> ${email}</p>
<p><strong>Message:</strong><br/>${message.replace(/\n/g, '<br/>')}</p>
<p><strong>Name:</strong> ${safeName}</p>
<p><strong>Email:</strong> ${safeEmail}</p>
<p><strong>Message:</strong><br/>${safeMessage}</p>
`
});
res.json({ ok: true });
} catch (error) {
console.error(error);
res.status(500).json({ ok: false, error: error.message });
res.status(500).json({ ok: false, error: 'Failed to send email. Please try again later.' });
}
});

Expand Down
38 changes: 31 additions & 7 deletions server/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,15 @@ const app = express();
app.use(cors());
app.use(express.json());

function escapeHtml(str) {
return String(str)
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#39;');
}

const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST,
port: +process.env.SMTP_PORT,
Expand All @@ -24,16 +33,31 @@ const transporter = nodemailer.createTransport({

app.post('/api/contact', async (req, res) => {
const { name, email, subject, message } = req.body;

if (!name?.trim() || !email?.trim() || !subject?.trim() || !message?.trim()) {
return res.status(400).json({ ok: false, error: 'All fields are required' });
}

const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
if (!emailRegex.test(email)) {
return res.status(400).json({ ok: false, error: 'Invalid email address' });
}

const safeName = escapeHtml(name.trim());
const safeEmail = escapeHtml(email.trim());
const safeSubject = escapeHtml(subject.trim());
const safeMessage = escapeHtml(message.trim()).replace(/\n/g, '<br/>');

try {
// Send notification email to yourself
await transporter.sendMail({
from: `Portfolio Contact <${process.env.SMTP_USER}>`,
to: process.env.RECIPIENT,
subject: `[Portfolio] ${subject} (from ${name})`,
subject: `[Portfolio] ${safeName} - ${safeSubject}`,
html: `
<p><strong>Name:</strong> ${name}</p>
<p><strong>Email:</strong> ${email}</p>
<p><strong>Message:</strong><br/>${message.replace(/\n/g, '<br/>')}</p>
<p><strong>Name:</strong> ${safeName}</p>
<p><strong>Email:</strong> ${safeEmail}</p>
<p><strong>Message:</strong><br/>${safeMessage}</p>
`
});

Expand All @@ -46,13 +70,13 @@ app.post('/api/contact', async (req, res) => {
<div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; color: #333;">
<h2 style="color: #3B82F6; border-bottom: 2px solid #3B82F6; padding-bottom: 10px;">Message Received</h2>

<p>Dear ${name},</p>
<p>Dear ${safeName},</p>

<p>Thank you for taking the time to reach out through my portfolio website. I have successfully received your message and truly appreciate your interest.</p>

<div style="background-color: #F3F4F6; border-left: 4px solid #3B82F6; padding: 15px; margin: 20px 0;">
<p style="margin: 0;"><strong>Your Message Details:</strong></p>
<p style="margin: 10px 0 0 0;"><strong>Subject:</strong> ${subject}</p>
<p style="margin: 10px 0 0 0;"><strong>Subject:</strong> ${safeSubject}</p>
</div>

<p>I make it a priority to respond to all inquiries promptly and will get back to you as soon as possible, typically within 24-48 hours.</p>
Expand Down Expand Up @@ -82,7 +106,7 @@ app.post('/api/contact', async (req, res) => {
res.json({ ok: true });
} catch (error) {
console.error(error);
res.status(500).json({ ok: false, error: error.message });
res.status(500).json({ ok: false, error: 'Failed to send email. Please try again later.' });
}
});

Expand Down