From e4187a697a2e04e312d2a262d26ea7f3f2112f8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sat, 4 Jul 2026 11:38:56 +0400
Subject: [PATCH] =?UTF-8?q?fix:=20envoyer=20le=20commentaire=20en=20texte?=
 =?UTF-8?q?=20brut=20(=C3=A9viter=20l'injection=20HTML)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../commentaire/__tests__/lifecycles.test.js  | 37 +++++++++++++++++++
 .../content-types/commentaire/lifecycles.js   |  2 +-
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 src/api/commentaire/content-types/commentaire/__tests__/lifecycles.test.js

diff --git a/src/api/commentaire/content-types/commentaire/__tests__/lifecycles.test.js b/src/api/commentaire/content-types/commentaire/__tests__/lifecycles.test.js
new file mode 100644
index 0000000..db02fd5
--- /dev/null
+++ b/src/api/commentaire/content-types/commentaire/__tests__/lifecycles.test.js
@@ -0,0 +1,37 @@
+import {describe, it, expect, vi, afterEach} from 'vitest'
+
+async function loadLifecycles(strapiMock) {
+  vi.resetModules()
+  global.strapi = strapiMock
+  const mod = await import('../lifecycles.js')
+  return mod
+}
+
+describe('commentaire afterCreate — notification email', () => {
+  afterEach(() => {
+    delete global.strapi
+  })
+
+  it("envoie le contenu en texte brut, jamais comme HTML non échappé", async () => {
+    const emailSend = vi.fn()
+    const strapiMock = {
+      db: {
+        query: vi.fn(uid => {
+          if (uid === 'plugin::users-permissions.user') return {findOne: vi.fn(async () => ({id: 1, username: 'foo'}))}
+          if (uid === 'api::parole.parole') return {findOne: vi.fn(async () => ({id: 7, titre: 'Mon titre'}))}
+          throw new Error(`unexpected uid: ${uid}`)
+        })
+      },
+      plugins: {email: {services: {email: {send: emailSend}}}}
+    }
+
+    const {afterCreate} = await loadLifecycles(strapiMock)
+
+    await afterCreate({params: {data: {user: 1, parole: 7, contenu: '<img src=x onerror=alert(1)>'}}})
+
+    expect(emailSend).toHaveBeenCalledTimes(1)
+    const [payload] = emailSend.mock.calls[0]
+    expect(payload.text).toBe('<img src=x onerror=alert(1)>')
+    expect(payload.html).toBeUndefined()
+  })
+})
diff --git a/src/api/commentaire/content-types/commentaire/lifecycles.js b/src/api/commentaire/content-types/commentaire/lifecycles.js
index 61f9ca4..eb2a599 100644
--- a/src/api/commentaire/content-types/commentaire/lifecycles.js
+++ b/src/api/commentaire/content-types/commentaire/lifecycles.js
@@ -59,7 +59,7 @@ module.exports = {
         from: process.env.SMTP_FROM,
         to: process.env.SMTP_SEND_TO,
         subject: `Commentaire de ${user.username} sur "${parole.titre}"`,
-        html: data.contenu
+        text: data.contenu
       })
     }
   }