src/api/commentaire/content-types/commentaire/__tests__/lifecycles.test.js

@@ -0,0 +1,37 @@
+import {describe, it, expect, vi, afterEach} from 'vitest'
+
+async function loadLifecycles(strapiMock) {
+  vi.resetModules()
+  global.strapi = strapiMock
+  const mod = await import('../lifecycles.js')
+  return mod
+}
+
+describe('commentaire afterCreate — notification email', () => {
+  afterEach(() => {
+    delete global.strapi
+  })
+
+  it("envoie le contenu en texte brut, jamais comme HTML non échappé", async () => {
+    const emailSend = vi.fn()
+    const strapiMock = {
+      db: {
+        query: vi.fn(uid => {
+          if (uid === 'plugin::users-permissions.user') return {findOne: vi.fn(async () => ({id: 1, username: 'foo'}))}
+          if (uid === 'api::parole.parole') return {findOne: vi.fn(async () => ({id: 7, titre: 'Mon titre'}))}
+          throw new Error(`unexpected uid: ${uid}`)
+        })
+      },
+      plugins: {email: {services: {email: {send: emailSend}}}}
+    }
+
+    const {afterCreate} = await loadLifecycles(strapiMock)
+
+    await afterCreate({params: {data: {user: 1, parole: 7, contenu: '<img src=x onerror=alert(1)>'}}})
+
+    expect(emailSend).toHaveBeenCalledTimes(1)
+    const [payload] = emailSend.mock.calls[0]
+    expect(payload.text).toBe('<img src=x onerror=alert(1)>')
+    expect(payload.html).toBeUndefined()
+  })
+})

src/api/commentaire/content-types/commentaire/lifecycles.js

@@ -59,7 +59,7 @@ module.exports = {
         from: process.env.SMTP_FROM,
         to: process.env.SMTP_SEND_TO,
         subject: `Commentaire de ${user.username} sur "${parole.titre}"`,
-        html: data.contenu
+        text: data.contenu
       })
     }
   }