From 0d66d7503d8fd147842e87b9b4f1b921986ef44b Mon Sep 17 00:00:00 2001
From: Jan Kahmen <36455663+kah-ja@users.noreply.github.com>
Date: Mon, 17 Aug 2026 23:03:41 +0200
Subject: [PATCH] fix(mail): stop interpreting iMIP card text fields as markup

the whole server built html of an iMIP card is rendered through sg-compile
(Message.service.js sets part.compile for UIxMailPartICalViewer), and the user
comment and the description are emitted with escapeHTML="NO". event data from
the invitation is therefore both an angular template and raw html.

47133fdf3 closed the description against interpolation with ng-non-bindable.
this closes both paths for every remaining field:

* ng-non-bindable on the user comment, the location, the organizer common name
  and the raw body shown when the calendar cannot be parsed
* the user comment and the description are read through accessors that escape
  them, so the url detection and insertBR produce the only markup left in the
  output

the marker sits on the leaf containers, not on md-card-content, so the buttons,
the delegation autocomplete and the attendee chips keep being compiled. url
detection still turns a bare url in a comment or a description into a link.
---
 UI/MailPartViewers/UIxMailPartICalViewer.h    |  2 ++
 UI/MailPartViewers/UIxMailPartICalViewer.m    | 11 ++++++++++
 .../MailPartViewers/UIxMailPartICalViewer.wox | 20 +++++++++----------
 3 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/UI/MailPartViewers/UIxMailPartICalViewer.h b/UI/MailPartViewers/UIxMailPartICalViewer.h
index 1ffde026e..bf12be30a 100644
--- a/UI/MailPartViewers/UIxMailPartICalViewer.h
+++ b/UI/MailPartViewers/UIxMailPartICalViewer.h
@@ -46,6 +46,8 @@
 - (BOOL) isEndDateOnSameDay;
 - (BOOL) hasLocation;
 - (NSString *)location;
+- (NSString *) userComment;
+- (NSString *) eventDescription;
 
 @end
 
diff --git a/UI/MailPartViewers/UIxMailPartICalViewer.m b/UI/MailPartViewers/UIxMailPartICalViewer.m
index f7cba20fd..d6dedac4b 100644
--- a/UI/MailPartViewers/UIxMailPartICalViewer.m
+++ b/UI/MailPartViewers/UIxMailPartICalViewer.m
@@ -32,6 +32,7 @@
 
 #import <NGExtensions/NSCalendarDate+misc.h>
 #import <NGExtensions/NSObject+Logs.h>
+#import <NGExtensions/NSString+misc.h>
 
 #import <NGImap4/NGImap4EnvelopeAddress.h>
 
@@ -612,4 +613,14 @@
   return [[self inEvent] location];
 }
 
+- (NSString *) userComment
+{
+  return [[[self inEvent] userComment] stringByEscapingHTMLString];
+}
+
+- (NSString *) eventDescription
+{
+  return [[[self authorativeEvent] comment] stringByEscapingHTMLString];
+}
+
 @end /* UIxMailPartICalViewer */
diff --git a/UI/Templates/MailPartViewers/UIxMailPartICalViewer.wox b/UI/Templates/MailPartViewers/UIxMailPartICalViewer.wox
index 873554c04..5ebf7a6b3 100644
--- a/UI/Templates/MailPartViewers/UIxMailPartICalViewer.wox
+++ b/UI/Templates/MailPartViewers/UIxMailPartICalViewer.wox
@@ -17,7 +17,7 @@
           </div>
       </md-toolbar>
       <md-whiteframe class="md-whiteframe-z1" layout="row" layout-align="space-between center">
-        <pre><var:string value="flatContentAsString" /></pre>
+        <pre ng-non-bindable=""><var:string value="flatContentAsString" /></pre>
       </md-whiteframe>
     </div>
   </var:if> <!-- if condition="couldParseCalendar" const:negate="1" -->
@@ -137,7 +137,7 @@
 
             <p>
               <var:string label:value="Organizer" />
-              <a var:href="inEvent.organizer.email"
+              <a ng-non-bindable="" var:href="inEvent.organizer.email"
 	         ><var:string value="organizerDisplayName" /></a>
               <var:string label:value="request_info" />
             </p>
@@ -147,7 +147,7 @@
           <var:if condition="isLoggedInUserAnAttendee" const:negate="YES">
             <p>
               <var:string label:value="Organizer" />
-              <a var:href="inEvent.organizer.email">
+              <a ng-non-bindable="" var:href="inEvent.organizer.email">
                 <var:string value="organizerDisplayName" />
               </a>
               <var:string label:value="request_info_no_attendee" />
@@ -233,14 +233,14 @@
         </var:if>
 
         <!-- the user comment is used in replies -->
-        <var:if condition="inEvent.userComment.isNotEmpty">
+        <var:if condition="userComment.isNotEmpty">
           <div class="pseudo-input-container">
             <label class="pseudo-input-label">
               <var:string label:value="Comment"/>
             </label>
-            <div>
+            <div ng-non-bindable="">
               <md-content>
-                <var:string value="inEvent.userComment.stringByDetectingURLs" const:insertBR="1" const:escapeHTML="NO"/>
+                <var:string value="userComment.stringByDetectingURLs" const:insertBR="1" const:escapeHTML="NO"/>
               </md-content>
             </div>
           </div>
@@ -251,7 +251,7 @@
 	<var:if condition="hasOrganizer" const:value="true">
           <div class="pseudo-input-container">
             <label class="pseudo-input-label"><var:string label:value="Organizer"/></label>
-            <div>
+            <div ng-non-bindable="">
               <var:string value="organizerDisplayName"/>
             </div>
           </div>
@@ -268,7 +268,7 @@
         <var:if condition="hasLocation">
           <div class="pseudo-input-container">
             <label class="pseudo-input-label"><var:string label:value="Location"/></label>
-            <div>
+            <div ng-non-bindable="">
               <var:string value="location"/>
             </div>
           </div>
@@ -294,14 +294,14 @@
           </div>
         </md-list>
 
-        <var:if condition="authorativeEvent.comment.isNotEmpty">
+        <var:if condition="eventDescription.isNotEmpty">
           <div class="pseudo-input-container">
             <label class="pseudo-input-label">
               <var:string label:value="Description"/>
             </label>
             <div ng-non-bindable="">
               <md-content>
-                <var:string value="authorativeEvent.comment.stringByDetectingURLs" const:insertBR="1" const:escapeHTML="NO"/>
+                <var:string value="eventDescription.stringByDetectingURLs" const:insertBR="1" const:escapeHTML="NO"/>
               </md-content>
             </div>
           </div>