Sendgrid-nodejs: Sendgrid escaping apostrophe to &apos

[galenweber]

Issue Summary

We are using @sendgrid/mail to send a transactional template with data passed via dynamic_template_data and rendered using Handlebars.

However, our users on older email clients have reported that apostrophe characters are being rendered as '. So they will see text like:

Hi, I hope you\'re doing well!

From a CX perspective, that's not ideal.

What I think is happening is that Sendgrid and Handlebars are escaping the apostrophe character to '. Shouldn't it be escaped to '?

If we use triple brackets in our templates {{{ myMessage }}} instead of double brackets it works as expected (because that prevents Sendgrid from escaping the text). However, Sendgrid documentation makes it seem like we only need to do this if we have the ', " or & characters in the subject line.

Can Sendgrid change how apostrophe characters are being escaped? If not, is there any danger to simply using triple brackets ({{{ message }}}) for all text we insert?

NOTE: it does look like Sendgrid warns against those characters in dynamic template data, but there's nothing in the docs to explain why that would be.

Steps to Reproduce

1. Create a transactional email template that includes handlebars templating to insert a value ( ie. {{ message }})
2. Use @sendgrid/mail to send that transactional template, passing the following for the dynamic_template_data property: { "message": "Hope you're doing well" }
3. Inspect the HTML of the email that is sent. The apostrophe character will have been replaced with '. That does not render well on older email clients.

I consider this a bug because Sendgrid is rendering ' instead of the officially supported
'.

Technical details:

"@sendgrid/mail": "^6.3.1"

• Node.js Version: 8.14.x

[childish-sambino]

The guidance for using triple brackets with special characters applies to both the subject and body.

As to why apostrophes are encoded differently than expected, best to reach out to support.

[tunminster]

why is this closed? i don't see the solution here. I've come to this same issue.

[idoshamun]

Same here...

[childish-sambino]

The guidance for using triple brackets with special characters applies to both the subject and body.

As to why apostrophes are encoded differently than expected, best to reach out to support.

[connor4312]

The guidance for using triple brackets with special characters applies to both the subject and body.

This allows HTML injection, though.

I'm kind of confused as to what to do here. If I use two braces in the message body, apostrophes are badly escaped

If I use three braces, they don't get escaped but I can then inject, for example <b>hi</b>

From what I can tell either I'm stuck with bad escaping, or no escaping, neither of which puts me in a good place when dealing with user-generated data.

Note that this is with a transaction template created in the visual editor -- maybe some bad interaction there?

[childish-sambino]

@connor4312 Understood and thanks for highlighting the issue. But since this is not something that can/should be directly addressed by this library, best to reach out to support.