goodmail 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 49fc7b9412bf9c59d6f4369f8a5ba26f7faaeffd982e98684dd294728254f1e9
-  data.tar.gz: 858a30035cba78799ee8b133d3531e531e952658d9270f35a80ed1fd9cf982ea
+  metadata.gz: 6e5f7b80a8e5d2b54ce69e8737358ce7eeda55ff7e3ba0f666aa566f8c254e79
+  data.tar.gz: 31c65395f2f014a7a8d2d031e444541b4aa0a40812346d4e298ffda5bcd98bee
 SHA512:
-  metadata.gz: 74d2b6dd4665aa63b5394d715d043193d03e64f0130913442f596db2663d546386bb06ea4fb6940966932877a09751b53972e95bbff619ec0d994fbcd29fc9af
-  data.tar.gz: 8469b9ea99e5de6b53f6c31c4edfb53c4eaee37eb5bf557351a9576456f5907b4fc032f3cb916961c595063f2449584d63ec038c5bc903ab21c2a8ab495fe791
+  metadata.gz: '09ad22554e994be1d26b59c476b7977e81333342b3dd12f5f4664438858dfb4c46abae1b1fcc29821c10d56702bf102494d2a6b1ee91372f8aeea78fc08ecd25'
+  data.tar.gz: e4e92e864d2ede0eef9ff398cf4ce312b49486203dc79b86a5a9dc708d4a66c7687c7b777ebcd68e718823afbbdf7305f05ba74b7b263c57172993dc3305a783

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.4.1] - 2026-10-24
+
+### Fixed
+
+- **The layout escapes the subject, the preheader and the unsubscribe URL.** The default layout wrote the subject into `<title>`, the hidden preheader and `<meta itemprop="name" content="…">`, and the unsubscribe URL into `href="…"`, without HTML escaping. A subject that holds a customer's own words (`Invoice from A&B "Shop" <Tienda>`) then broke the attribute or added markup, and a subject cannot carry entities of its own. All four values are now escaped with `ERB::Util.html_escape`. The body stays as the Builder made it. A custom layout (`layout_path:`) must escape these values itself.
+
 ## [0.4.0] - 2026-05-08
 
 A polish-and-correctness release. Adds five new DSL helpers, a comprehensive Minitest 6 test suite (100% line coverage), and fixes nine real-world bugs that surfaced after running every email shape through Mailcatcher and inspecting the rendered HTML, plaintext, headers, and attachments end-to-end. The bug fixes are the headline — most of them silently degraded plaintext quality, deliverability, or accessibility before; downstream apps inherit the fixes for free on upgrade.

data/lib/goodmail/action_mailer_integration.rb

@@ -54,8 +54,18 @@ module Goodmail
   # Rails intentionally accepts arbitrary message headers and filters only
   # framework-only render keys internally; Goodmail should follow that shape
   # instead of maintaining a narrow whitelist of envelope fields.
-  # Source:
-  # https://github.com/rails/rails/blob/debbd18c562df17d01944c475e9291d927910b58/actionmailer/lib/action_mailer/base.rb#L972-L976
+  #
+  # Do not validate `to`, `from`, or `reply_to` here. Goodmail owns rendering
+  # and the mechanical Action Mailer handoff, while address acceptance belongs
+  # to the caller and its delivery provider. For example, SES requires ASCII
+  # addresses shaped as `UserName@[SubDomain.]Domain.TopLevelDomain`; another
+  # adapter may support SMTPUTF8 or intentionally use local test domains.
+  #
+  # Sources:
+  # - Rails header handling:
+  #   https://github.com/rails/rails/blob/debbd18c562df17d01944c475e9291d927910b58/actionmailer/lib/action_mailer/base.rb#L972-L976
+  # - SES-specific recipient and SMTPUTF8 constraints:
+  #   https://docs.aws.amazon.com/ses/latest/APIReference/API_SendRawEmail.html
   def self.action_mailer_headers(headers)
     headers.each_with_object({}) do |(key, value), result|
       next if render_header_key?(key)

data/lib/goodmail/layout.erb

@@ -3,7 +3,7 @@
 <head>
   <meta name="viewport" content="width=device-width" />
   <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-  <title><%= subject %></title>
+  <title><%= ERB::Util.html_escape(subject) %></title>
   <style type="text/css">
     /* Base Styles */
     img {
@@ -162,7 +162,7 @@
 
 <!-- Hidden Preheader Text -->
 <span style="display:none !important; font-size:1px; color:#ffffff; line-height:1px; max-height:0px; max-width:0px; opacity:0; overflow:hidden;">
-  <%= preheader || subject %>
+  <%= ERB::Util.html_escape(preheader || subject) %>
 </span>
 
 <table class="body-wrap" style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; width: 100%; background-color: #f6f6f6; margin: 0;" bgcolor="#f6f6f6">
@@ -192,7 +192,7 @@
         <table class="main" width="100%" cellpadding="0" cellspacing="0" itemprop="action" itemscope itemtype="http://schema.org/ConfirmAction" style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; border-radius: 3px; background-color: #fff; margin: 0; border: 1px solid #e9e9e9;" bgcolor="#fff">
           <tr style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; margin: 0;">
             <td class="content-wrap" style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; vertical-align: top; margin: 0; padding: 30px;" valign="top">
-              <meta itemprop="name" content="<%= subject %>" />
+              <meta itemprop="name" content="<%= ERB::Util.html_escape(subject) %>" />
               <table width="100%" cellpadding="0" cellspacing="0" style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; margin: 0;">
                 <tr style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; margin: 0;">
                   <td style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; vertical-align: top; margin: 0;" valign="top">
@@ -228,7 +228,7 @@
             <% if config.show_footer_unsubscribe_link && defined?(unsubscribe_url) && unsubscribe_url.present? %>
               <tr style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; margin: 0;">
                 <td class="aligncenter content-block" style="font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: border-box; font-size: 12px; vertical-align: top; text-align: center; margin: 0; padding: 0 0 10px; color: #999;" align="center" valign="top">
-                  <a href="<%= unsubscribe_url %>" style="color: #999;"><%= config.footer_unsubscribe_link_text %></a>
+                  <a href="<%= ERB::Util.html_escape(unsubscribe_url) %>" style="color: #999;"><%= config.footer_unsubscribe_link_text %></a>
                 </td>
               </tr>
             <% end %>

data/lib/goodmail/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Goodmail
-  VERSION = "0.4.0"
+  VERSION = "0.4.1"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: goodmail
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-05-21 00:00:00.000000000 Z
+date: 2026-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: premailer-rails