fix: Prevents path injection on unsubscribe

2026-10-11 21:13:12 -04:00 · 2026-10-05 14:33:52 -03:00
parent 8a11c29cce
commit b7d2f3664e
1 changed files with 1 additions and 1 deletions
@@ -51,7 +51,7 @@ export class ActionsController extends BaseHttpController {
    await this.serviceProxy.callEmailServer(
      request,
      response,
-      `subscriptions/actions/unsubscribe/${request.params.token}`,
+      `subscriptions/actions/unsubscribe/${encodeURIComponent(request.params.token)}`,
      request.body,
    )
  }