packages/emails/src/templates/BaseScheduledEmail.tsx (2)

91-131: Use sanitized data for all user-provided fields to prevent HTML injection.

The following fields should use data from sanitizedCalEvent instead of props.calEvent:

• rejectionReason (line 91)
• cancellationReason (line 102)
• title (line 127)
• description (line 131)

Additionally, props.reassigned.reason (line 122) and rescheduledBy (line 126) should also be sanitized.

Apply this diff to use sanitized data consistently:

-      {props.calEvent.rejectionReason && (
+      {sanitizedCalEvent.rejectionReason && (
         <>
-          <Info label={t("rejection_reason")} description={props.calEvent.rejectionReason} withSpacer />
+          <Info label={t("rejection_reason")} description={sanitizedCalEvent.rejectionReason} withSpacer />
         </>
       )}
-      {props.calEvent.cancellationReason && (
+      {sanitizedCalEvent.cancellationReason && (
         <Info
           label={t(
-            props.calEvent.cancellationReason.startsWith("$RCH$")
+            sanitizedCalEvent.cancellationReason.startsWith("$RCH$")
               ? "reason_for_reschedule"
               : "cancellation_reason"
           )}
           description={
-            !!props.calEvent.cancellationReason && props.calEvent.cancellationReason.replace("$RCH$", "")
+            !!sanitizedCalEvent.cancellationReason && sanitizedCalEvent.cancellationReason.replace("$RCH$", "")
           } // Removing flag to distinguish reschedule from cancellation
           withSpacer
         />
       )}

       {props.reassigned && props.reassigned.byUser && (
         <>
           <Info label={t("reassigned_by")} description={props.reassigned.byUser} withSpacer />
           {props.reassigned?.reason && (
-            <Info label={t("reason")} description={props.reassigned.reason} withSpacer />
+            <Info label={t("reason")} description={sanitizeText(props.reassigned.reason)} withSpacer />
           )}
         </>
       )}
-      {rescheduledBy && <Info label={t("rescheduled_by")} description={rescheduledBy} withSpacer />}
-      <Info label={t("what")} description={props.calEvent.title} withSpacer />
+      {rescheduledBy && <Info label={t("rescheduled_by")} description={sanitizeText(rescheduledBy)} withSpacer />}
+      <Info label={t("what")} description={sanitizedCalEvent.title} withSpacer />

       <WhoInfo calEvent={props.calEvent} t={t} />
       <LocationInfo calEvent={props.calEvent} t={t} />
-      <Info label={t("description")} description={props.calEvent.description} withSpacer formatted />
+      <Info label={t("description")} description={sanitizedCalEvent.description} withSpacer formatted />

Note: You'll need to import sanitizeText from @calcom/lib/CalEventParser to sanitize individual fields like reassigned.reason and rescheduledBy.

---

128-130: Pass sanitized event data to child components.

The WhenInfo, WhoInfo, and LocationInfo components still receive the unsanitized props.calEvent. If these components display any text fields, they could still render malicious content.

-      <WhenInfo timeFormat={timeFormat} calEvent={props.calEvent} t={t} timeZone={timeZone} locale={locale} />
-      <WhoInfo calEvent={props.calEvent} t={t} />
-      <LocationInfo calEvent={props.calEvent} t={t} />
+      <WhenInfo timeFormat={timeFormat} calEvent={sanitizedCalEvent} t={t} timeZone={timeZone} locale={locale} />
+      <WhoInfo calEvent={sanitizedCalEvent} t={t} />
+      <LocationInfo calEvent={sanitizedCalEvent} t={t} />

packages/lib/CalEventParser.ts (1)

133-139: Use consistent sanitization by applying sanitizeText function.

The getDescription function has its own HTML stripping logic which differs from the sanitizeText function. This could lead to inconsistent sanitization across the application.

 export const getDescription = (calEvent: Pick<CalendarEvent, "description">, t: TFunction) => {
   if (!calEvent.description) {
     return "";
   }
-  const plainText = calEvent.description.replace(/<\/?[^>]+(>|$)/g, "").replace(/_/g, " ");
-  return `${t("description")}\n${plainText}`;
+  return `${t("description")}\n${sanitizeText(calEvent.description)}`;
 };

Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro

packages/lib/CalEventParser.ts (1)

34-40: Export the sanitizeText function for broader usage.

The sanitizeText function should be exported to enable its use in other modules, as mentioned in previous reviews.

-export const sanitizeText = (input: string | null | undefined): string => {
+export const sanitizeText = (input: string | null | undefined): string => {

Wait, I see it's already exported. Let me check the implementation logic instead.

Review the sanitization logic for completeness.

The implementation correctly handles null/undefined inputs and follows a proper sanitization flow: markdown → HTML stripping → URL obfuscation.

packages/emails/src/templates/BaseScheduledEmail.tsx (2)

96-100: Remove unnecessary Fragment wrapper.

The Fragment wrapper is redundant when it contains only one child element.

-      {rejectionReason && (
-        <>
-          <Info label={t("rejection_reason")} description={rejectionReason} withSpacer />
-        </>
-      )}
+      {rejectionReason && (
+        <Info label={t("rejection_reason")} description={rejectionReason} withSpacer />
+      )}

---

122-126: Use optional chaining for cleaner code.

The conditional check can be simplified using optional chaining.

-      {props.reassigned && props.reassigned.byUser && (
+      {props.reassigned?.byUser && (
         <>
           <Info label={t("reassigned_by")} description={reassignedByUser} withSpacer />
           {reassignedReason && <Info label={t("reason")} description={reassignedReason} withSpacer />}
         </>
       )}

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/features/insights/components/FailedBookingsByField.tsx:65-71
Timestamp: 2025-07-15T12:59:34.341Z
Learning: In the FailedBookingsByField component (packages/features/insights/components/FailedBookingsByField.tsx), although routingFormId is typed as optional in useInsightsParameters, the system automatically enforces a routing form filter, so routingFormId is always present in practice. This means the data always contains only one entry, making the single-entry destructuring approach safe.

packages/lib/CalEventParser.ts (1)

410-478: Comprehensive sanitization implementation with minor suggestion.

The sanitization functions properly handle all user-provided text fields and create deep copies to prevent mutation. The nested object handling is appropriate for the current data structures.

Consider making the responses sanitization more robust by recursively handling nested objects instead of assuming only "value" property objects exist.

For more robust nested object handling in responses:

-        Object.entries(sanitized.responses).map(([key, value]) => {
-          if (typeof value === "object" && value !== null && "value" in value) {
-            return [
-              key,
-              {
-                ...value,
-                value: typeof value.value === "string" ? sanitizeText(value.value) : String(value.value),
-              },
-            ];
-          }
-          return [key, typeof value === "string" ? sanitizeText(value) : String(value)];
-        })
+        Object.entries(sanitized.responses).map(([key, value]) => {
+          const sanitizeNestedValue = (obj: any): any => {
+            if (typeof obj === "string") return sanitizeText(obj);
+            if (typeof obj === "object" && obj !== null) {
+              return Object.fromEntries(
+                Object.entries(obj).map(([k, v]) => [k, sanitizeNestedValue(v)])
+              );
+            }
+            return String(obj);
+          };
+          return [key, sanitizeNestedValue(value)];
+        })

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: hariombalhara
PR: calcom/cal.com#22547
File: packages/embeds/embed-core/src/lib/eventHandlers/scrollByDistanceEventHandler.ts:11-14
Timestamp: 2025-07-16T11:46:28.738Z
Learning: In Cal.com's embed system, internal events like "__scrollByDistance" are fired by Cal.com's own code, so runtime validation of event data structure is unnecessary since TypeScript type system guarantees type safety for internal events.

Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/features/insights/components/FailedBookingsByField.tsx:65-71
Timestamp: 2025-07-15T12:59:34.341Z
Learning: In the FailedBookingsByField component (packages/features/insights/components/FailedBookingsByField.tsx), although routingFormId is typed as optional in useInsightsParameters, the system automatically enforces a routing form filter, so routingFormId is always present in practice. This means the data always contains only one entry, making the single-entry destructuring approach safe.