From dd40a6c04b6c0834c77a4ef6e484c2dad8ce8651 Mon Sep 17 00:00:00 2001
From: Erik Michelson <github@erik.michelson.eu>
Date: Wed, 17 Jun 2026 22:35:16 +0200
Subject: [PATCH] fix(auth): sanitize email addresses

Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
---
 lib/models/user.js           | 7 ++++---
 public/docs/release-notes.md | 7 +++++++
 public/views/pretty.ejs      | 4 ++--
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/lib/models/user.js b/lib/models/user.js
index ff154745..befd95ff 100644
--- a/lib/models/user.js
+++ b/lib/models/user.js
@@ -143,10 +143,11 @@ module.exports = function (sequelize, DataTypes) {
     return filterXSS(photo)
   }
   User.parseProfileByEmail = function (email) {
+    const sanitizedEmail = email.replaceAll('"', '').replaceAll("'", '').replaceAll('<', '').replaceAll('>', '')
     return {
-      name: email.substring(0, email.lastIndexOf('@')),
-      photo: generateAvatarURL('', email, false),
-      biggerphoto: generateAvatarURL('', email, true)
+      name: sanitizedEmail.split('@')[0],
+      photo: generateAvatarURL('', sanitizedEmail, false),
+      biggerphoto: generateAvatarURL('', sanitizedEmail, true)
     }
   }
 
diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md
index e49ac73f..5916b9f7 100644
--- a/public/docs/release-notes.md
+++ b/public/docs/release-notes.md
@@ -2,6 +2,13 @@
 
 ## <i class="fa fa-tag"></i> 1.x <i class="fa fa-calendar-o"></i> UNRELEASED
 
+### Security fixes
+
+This release contains a ... security fix:
+- [GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv) reports a possible HTML injection via the localpart of an email address.
+
+Thanks to [Chandler Johnson](https://github.com/chndlrx) for reporting!
+
 ### Enhancements
 
 - Added a warning page when clicking external links
diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs
index 97274ba1..5ee3645f 100644
--- a/public/views/pretty.ejs
+++ b/public/views/pretty.ejs
@@ -34,7 +34,7 @@
         <small>
             <span>
                 <% if(lastchangeuserprofile) { %>
-                    <span class="ui-lastchangeuser">&thinsp;<i class="ui-user-icon small" style="background-image: url(<%- lastchangeuserprofile.photo %>);" data-toggle="tooltip" data-placement="right" title="<%- lastchangeuserprofile.name %>"></i></span>
+                    <span class="ui-lastchangeuser">&thinsp;<i class="ui-user-icon small" style="background-image: url(<%- lastchangeuserprofile.photo %>);" data-toggle="tooltip" data-placement="right" title="<%= lastchangeuserprofile.name %>"></i></span>
                 <% } else { %>
                   <span class="ui-no-lastchangeuser">&thinsp;<i class="fa fa-clock-o fa-fw" style="width: 18px;"></i></span>
                 <% } %>
@@ -45,7 +45,7 @@
             <br>
             <% if(ownerprofile && owner !== lastchangeuser) { %>
             <span class="ui-owner">
-                &thinsp;<i class="ui-user-icon small" style="background-image: url(<%- ownerprofile.photo %>);" data-toggle="tooltip" data-placement="right" title="<%- ownerprofile.name %>"></i>
+                &thinsp;<i class="ui-user-icon small" style="background-image: url(<%- ownerprofile.photo %>);" data-toggle="tooltip" data-placement="right" title="<%= ownerprofile.name %>"></i>
                 &nbsp;<span class="text-uppercase">owned this note</span>
             </span>
             <% } %>