fix: Sanitize email template body with HTMLPurifier (#1105)

Author: daveearley

backend/app/Services/Application/Handlers/EmailTemplate/CreateEmailTemplateHandler.php

@@ -8,12 +8,14 @@
 use HiEvents\Repository\Interfaces\EmailTemplateRepositoryInterface;
 use HiEvents\Services\Application\Handlers\EmailTemplate\DTO\UpsertEmailTemplateDTO;
 use HiEvents\Services\Domain\Email\EmailTemplateService;
+use HiEvents\Services\Infrastructure\HtmlPurifier\HtmlPurifierService;
 
 class CreateEmailTemplateHandler
 {
     public function __construct(
         private readonly EmailTemplateRepositoryInterface $emailTemplateRepository,
         private readonly EmailTemplateService             $emailTemplateService,
+        private readonly HtmlPurifierService              $purifier,
     )
     {
     }
@@ -50,7 +52,7 @@ public function handle(UpsertEmailTemplateDTO $dto): EmailTemplateDomainObject
             'event_id' => $dto->event_id,
             'template_type' => $dto->template_type->value,
             'subject' => $dto->subject,
-            'body' => $dto->body,
+            'body' => $this->purifier->purify($dto->body),
             'cta' => $dto->cta,
             'engine' => $dto->engine->value,
             'is_active' => $dto->is_active,

backend/app/Services/Application/Handlers/EmailTemplate/UpdateEmailTemplateHandler.php

@@ -9,12 +9,14 @@
 use HiEvents\Repository\Interfaces\EmailTemplateRepositoryInterface;
 use HiEvents\Services\Application\Handlers\EmailTemplate\DTO\UpsertEmailTemplateDTO;
 use HiEvents\Services\Domain\Email\EmailTemplateService;
+use HiEvents\Services\Infrastructure\HtmlPurifier\HtmlPurifierService;
 
 class UpdateEmailTemplateHandler
 {
     public function __construct(
         private readonly EmailTemplateRepositoryInterface $emailTemplateRepository,
-        private readonly EmailTemplateService $emailTemplateService
+        private readonly EmailTemplateService $emailTemplateService,
+        private readonly HtmlPurifierService $purifier,
     ) {
     }
 
@@ -47,7 +49,7 @@ public function handle(UpsertEmailTemplateDTO $dto): EmailTemplateDomainObject
 
         return $this->emailTemplateRepository->updateFromArray($template->getId(), [
             'subject' => $dto->subject,
-            'body' => $dto->body,
+            'body' => $this->purifier->purify($dto->body),
             'cta' => $dto->cta,
             'engine' => $dto->engine->value,
             'is_active' => $dto->is_active,