CarrotSkin/backend
6
1
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

添加 HTML 转义，防止邮件内容中的 HTML 注入攻击 #3

Open
WuYvbo wants to merge 3 commits from email into dev
pull from: email
merge into: CarrotSkin:dev
Conversation 1 Commits 3 Files Changed 8 +6 -3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 133c46c086 - Show all commits

9
pkg/email/email.go
View File

@@ -5,6 +5,7 @@ import (
"fmt" "fmt"
"net/smtp" "net/smtp"
"net/textproto" "net/textproto"
"html"
"carrotskin/pkg/config" "carrotskin/pkg/config"
@@ -70,8 +71,6 @@ func (s *Service) send(to []string, subject, body string) error {
addr := fmt.Sprintf("%s:%d", s.cfg.SMTPHost, s.cfg.SMTPPort) addr := fmt.Sprintf("%s:%d", s.cfg.SMTPHost, s.cfg.SMTPPort)
// 判断端口决定发送方式 // 判断端口决定发送方式
// 465端口使用SSL/TLS（隐式TLS）
// 587端口使用STARTTLS（显式TLS）
var err error var err error
if s.cfg.SMTPPort == 465 { if s.cfg.SMTPPort == 465 {
// 使用SSL/TLS连接（适用于465端口） // 使用SSL/TLS连接（适用于465端口）
@@ -132,6 +131,10 @@ func (s *Service) getBody(code, purpose string) string {
message = "您的验证码为：" message = "您的验证码为："
} }
// 转义 HTML 特殊字符
escapedMessage := html.EscapeString(message)
escapedCode := html.EscapeString(code)
return fmt.Sprintf(` return fmt.Sprintf(`
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
@@ -158,5 +161,5 @@ func (s *Service) getBody(code, purpose string) string {
</div> </div>
</body> </body>
</html> </html>
`, message, code) `, escapedMessage, escapedCode)
} }