From 4df40cb77264ac4f2d5dd99b4736b06728ea3daa Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Wed, 9 Sep 2026 20:23:26 +0930
Subject: [PATCH] Escape user-provided content in curated register admin emails

---
 .../curated-register/admin_notify.blade.php   |  2 +-
 .../admin_notify_user_response.blade.php      |  2 +-
 .../CuratedRegisterEmailEscapeTest.php        | 45 +++++++++++++++++++
 3 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/CuratedRegisterEmailEscapeTest.php

diff --git a/resources/views/emails/curated-register/admin_notify.blade.php b/resources/views/emails/curated-register/admin_notify.blade.php
index 15090cc43..5e85e6f91 100644
--- a/resources/views/emails/curated-register/admin_notify.blade.php
+++ b/resources/views/emails/curated-register/admin_notify.blade.php
@@ -19,7 +19,7 @@ Email: <strong>{{ $verify->email }}</strong>
 <hr>
 
 <small><strong>*The user provided the following reason to join:*</strong></small>
-<p style="font-size:9pt;">{!!Str::limit(nl2br($verify->reason_to_join), 300)!!}</p>
+<p style="font-size:9pt;">{!! nl2br(e(Str::limit($verify->reason_to_join, 300))) !!}</p>
 </x-mail::panel>
 
 <x-mail::button :url="$verify->adminReviewUrl()" color="success">
diff --git a/resources/views/emails/curated-register/admin_notify_user_response.blade.php b/resources/views/emails/curated-register/admin_notify_user_response.blade.php
index 504795f83..3fbad7668 100644
--- a/resources/views/emails/curated-register/admin_notify_user_response.blade.php
+++ b/resources/views/emails/curated-register/admin_notify_user_response.blade.php
@@ -6,7 +6,7 @@ Hello,
 You have a new response from a curated onboarding application from **{{$activity->application->email}}**.
 
 <x-mail::panel>
-<p style="white-space: pre-wrap;">{!! $activity->message !!}</p>
+<p style="white-space: pre-wrap;">{!! nl2br(e($activity->message)) !!}</p>
 </x-mail::panel>
 
 <x-mail::button :url="$activity->adminReviewUrl()" color="success">
diff --git a/tests/Feature/CuratedRegisterEmailEscapeTest.php b/tests/Feature/CuratedRegisterEmailEscapeTest.php
new file mode 100644
index 000000000..ad2f467f2
--- /dev/null
+++ b/tests/Feature/CuratedRegisterEmailEscapeTest.php
@@ -0,0 +1,45 @@
+<?php
+
+use App\Mail\CuratedRegisterNotifyAdmin;
+use App\Mail\CuratedRegisterNotifyAdminUserResponse;
+use App\Models\CuratedRegister;
+use App\Models\CuratedRegisterActivity;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+
+uses(LazilyRefreshDatabase::class);
+
+/*
+|--------------------------------------------------------------------------
+| Curated register admin email escaping
+|--------------------------------------------------------------------------
+|
+| User-provided reason_to_join / response message must be HTML-escaped in the
+| admin notification emails (prevents injected phishing UI), while preserving
+| line breaks.
+|
+*/
+
+it('escapes user-provided content in the admin notification emails', function () {
+    $verify = new CuratedRegister;
+    $verify->username = 'attacker';
+    $verify->email = 'attacker@example.com';
+    $verify->reason_to_join = "<script>alert(1)</script>\nsecond line";
+    $verify->save();
+
+    $applicationHtml = (new CuratedRegisterNotifyAdmin($verify))->render();
+
+    expect($applicationHtml)->not->toContain('<script>alert(1)</script>');
+    expect($applicationHtml)->toContain('&lt;script&gt;');
+    // Line breaks preserved via nl2br.
+    expect($applicationHtml)->toContain('<br');
+
+    $activity = new CuratedRegisterActivity;
+    $activity->register_id = $verify->id;
+    $activity->message = '<script>alert(2)</script>';
+    $activity->save();
+
+    $responseHtml = (new CuratedRegisterNotifyAdminUserResponse($activity))->render();
+
+    expect($responseHtml)->not->toContain('<script>alert(2)</script>');
+    expect($responseHtml)->toContain('&lt;script&gt;');
+});