<div dir="ltr">Hi everyone,<div><br></div><div>After a security audit we've found out that by user registration one can do HTML injection by inserting for example the following code in the Name field: Victim<p><a href=<a href="http://www.google.ch" target="_blank">www.google.ch</a>>Konto aktivieren</a></div><div><br></div><div>The victim receives the validation email with the malicious link right after their name. Therefore the injected html is rendered instead of escaped by the email service. Is there any way we can avoid this declaratively or what would be an alternative solution? </div><div><br></div><div>Best regards,</div><div>Adrian </div>
</div>