Skip to content

[PM-37648] Fix double HTML encoding in emergency access emails#7652

Open
singhvishalkr wants to merge 1 commit into
bitwarden:mainfrom
singhvishalkr:fix-emergency-access-email-encoding
Open

[PM-37648] Fix double HTML encoding in emergency access emails#7652
singhvishalkr wants to merge 1 commit into
bitwarden:mainfrom
singhvishalkr:fix-emergency-access-email-encoding

Conversation

@singhvishalkr
Copy link
Copy Markdown

Fixes #4845

When sending emergency access emails, names with special characters like German umlauts appear as HTML entities (e.g., Stephan Windmüller instead of Stephan Windmüller).

The root cause is double HTML encoding:

  1. CoreHelpers.SanitizeForEmail(name) encodes the name (htmlEncode defaults to true)
  2. Handlebars templates also escape values when rendering

Other email methods in the same file already pass false to avoid this (e.g., SendProviderInviteEmailAsync). This change applies the same pattern to all emergency access email methods:

  • SendEmergencyAccessInviteEmailAsync
  • SendEmergencyAccessConfirmedEmailAsync
  • SendEmergencyAccessRecoveryInitiated
  • SendEmergencyAccessRecoveryApproved
  • SendEmergencyAccessRecoveryRejected
  • SendEmergencyAccessRecoveryReminder
  • SendEmergencyAccessRecoveryTimedOut

Tested by reviewing the code path and confirming the fix matches existing patterns.

The SanitizeForEmail method HTML-encodes by default, but Handlebars
templates also escape values. This caused names with special characters
like umlauts to display as HTML entities (e.g. Windm&bitwarden#252;ller).

Pass htmlEncode=false to match the pattern used elsewhere in this file.
@singhvishalkr singhvishalkr requested a review from a team as a code owner May 16, 2026 06:40
@singhvishalkr singhvishalkr requested a review from dereknance May 16, 2026 06:40
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented May 16, 2026

CLA assistant check
All committers have signed the CLA.

@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@bitwarden-bot
Copy link
Copy Markdown
Collaborator

Thank you for your contribution! We've added this to our internal tracking system for review.
ID: PM-37648
Link: https://bitwarden.atlassian.net/browse/PM-37648

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

@bitwarden-bot bitwarden-bot changed the title Fix double HTML encoding in emergency access emails [PM-37648] Fix double HTML encoding in emergency access emails May 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Emergency Access E-Mails use Wrong Encoding for Names

3 participants