From 0ee476cfff950b4a815fb4410e9ae161c64c34cb Mon Sep 17 00:00:00 2001
From: Ulf Gebhardt <ulf.gebhardt@webcraft-media.de>
Date: Tue, 27 Jan 2026 23:39:40 +0100
Subject: [PATCH] fix(backend): fix email url encoding (#9127)

---
 backend/src/emails/sendEmail.ts | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/backend/src/emails/sendEmail.ts b/backend/src/emails/sendEmail.ts
index faff75718..1690734a0 100644
--- a/backend/src/emails/sendEmail.ts
+++ b/backend/src/emails/sendEmail.ts
@@ -2,7 +2,6 @@
 
 /* eslint-disable @typescript-eslint/no-unsafe-member-access */
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
-/* eslint-disable @typescript-eslint/restrict-template-expressions */
 import path from 'node:path'
 
 import Email from 'email-templates'
@@ -94,8 +93,8 @@ export const sendNotificationMail = async (notification: any): Promise<OriginalM
             : notification?.from?.title,
         postUrl: new URL(
           notification?.from?.__typename === 'Comment'
-            ? `/post/${notification?.from?.post?.id}/${notification?.from?.post?.slug}`
-            : `/post/${notification?.from?.id}/${notification?.from?.slug}`,
+            ? `/post/${encodeURIComponent(notification?.from?.post?.id)}/${encodeURIComponent(notification?.from?.post?.slug)}`
+            : `/post/${encodeURIComponent(notification?.from?.id)}/${encodeURIComponent(notification?.from?.slug)}`,
           CONFIG.CLIENT_URI,
         ),
         postAuthorName:
@@ -106,7 +105,7 @@ export const sendNotificationMail = async (notification: any): Promise<OriginalM
           notification?.from?.__typename === 'Comment'
             ? undefined
             : new URL(
-                `profile/${notification?.from?.author?.id}/${notification?.from?.author?.slug}`,
+                `profile/${encodeURIComponent(notification?.from?.author?.id)}/${encodeURIComponent(notification?.from?.author?.slug)}`,
                 CONFIG.CLIENT_URI,
               ),
         commenterName:
@@ -116,14 +115,14 @@ export const sendNotificationMail = async (notification: any): Promise<OriginalM
         commenterUrl:
           notification?.from?.__typename === 'Comment'
             ? new URL(
-                `/profile/${notification?.from?.author?.id}/${notification?.from?.author?.slug}`,
+                `/profile/${encodeURIComponent(notification?.from?.author?.id)}/${encodeURIComponent(notification?.from?.author?.slug)}`,
                 CONFIG.CLIENT_URI,
               )
             : undefined,
         commentUrl:
           notification?.from?.__typename === 'Comment'
             ? new URL(
-                `/post/${notification?.from?.post?.id}/${notification?.from?.post?.slug}#commentId-${notification?.from?.id}`,
+                `/post/${encodeURIComponent(notification?.from?.post?.id)}/${encodeURIComponent(notification?.from?.post?.slug)}#commentId-${encodeURIComponent(notification?.from?.id)}`,
                 CONFIG.CLIENT_URI,
               )
             : undefined,
@@ -132,7 +131,7 @@ export const sendNotificationMail = async (notification: any): Promise<OriginalM
         groupUrl:
           notification?.from?.__typename === 'Group'
             ? new URL(
-                `/groups/${notification?.from?.id}/${notification?.from?.slug}`,
+                `/groups/${encodeURIComponent(notification?.from?.id)}/${encodeURIComponent(notification?.from?.slug)}`,
                 CONFIG.CLIENT_URI,
               )
             : undefined,
@@ -143,7 +142,7 @@ export const sendNotificationMail = async (notification: any): Promise<OriginalM
         groupRelatedUserUrl:
           notification?.from?.__typename === 'Group'
             ? new URL(
-                `/profile/${notification?.relatedUser?.id}/${notification?.relatedUser?.slug}`,
+                `/profile/${encodeURIComponent(notification?.relatedUser?.id)}/${encodeURIComponent(notification?.relatedUser?.slug)}`,
                 CONFIG.CLIENT_URI,
               )
             : undefined,
@@ -177,7 +176,10 @@ export const sendChatMessageMail = async (
         locale: recipientUser.locale,
         name: recipientUser.name,
         chattingUser: senderUser.name,
-        chattingUserUrl: new URL(`/profile/${senderUser.id}/${senderUser.slug}`, CONFIG.CLIENT_URI),
+        chattingUserUrl: new URL(
+          `/profile/${encodeURIComponent(senderUser.id)}/${encodeURIComponent(senderUser.slug)}`,
+          CONFIG.CLIENT_URI,
+        ),
         chatUrl: new URL('/chat', CONFIG.CLIENT_URI),
       },
     })