From d545a9e127c70f5fbdf4dfc5d25cb43bb8f892fc Mon Sep 17 00:00:00 2001
From: Nafees Nazik <84864519+G3root@users.noreply.github.com>
Date: Tue, 14 Mar 2023 03:33:06 +0530
Subject: [PATCH] Fix save booking title unescaped (#7591)

Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
---
 apps/web/components/booking/BookingListItem.tsx | 2 +-
 apps/web/package.json                           | 1 +
 packages/core/event.ts                          | 3 +++
 packages/emails/templates/_base-email.ts        | 3 ++-
 4 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/apps/web/components/booking/BookingListItem.tsx b/apps/web/components/booking/BookingListItem.tsx
index 01a775fbb9..f908d11ddb 100644
--- a/apps/web/components/booking/BookingListItem.tsx
+++ b/apps/web/components/booking/BookingListItem.tsx
@@ -224,7 +224,7 @@ function BookingListItem(booking: BookingItemProps) {
   const showRecordingsButtons =
     (booking.location === "integrations:daily" || booking?.location?.trim() === "") && isPast && isConfirmed;
 
-  const title = decodeURIComponent(booking.title);
+  const title = booking.title;
   return (
     <>
       <RescheduleDialog
diff --git a/apps/web/package.json b/apps/web/package.json
index bdc48375c4..25131dc21d 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -69,6 +69,7 @@
     "bcryptjs": "^2.4.3",
     "classnames": "^2.3.1",
     "dotenv-cli": "^6.0.0",
+    "entities": "^4.4.0",
     "eslint-config-next": "^13.2.1",
     "googleapis": "^84.0.0",
     "gray-matter": "^4.0.3",
diff --git a/packages/core/event.ts b/packages/core/event.ts
index 691181574a..1f782520c5 100644
--- a/packages/core/event.ts
+++ b/packages/core/event.ts
@@ -19,6 +19,9 @@ export function getEventName(eventNameObj: EventNameObjectType, forAttendeeView
       eventName: eventNameObj.eventType,
       host: eventNameObj.host,
       attendeeName: eventNameObj.attendeeName,
+      interpolation: {
+        escapeValue: false,
+      },
     });
 
   let eventName = eventNameObj.eventName;
diff --git a/packages/emails/templates/_base-email.ts b/packages/emails/templates/_base-email.ts
index 9d25a8cde5..c8994dc47c 100644
--- a/packages/emails/templates/_base-email.ts
+++ b/packages/emails/templates/_base-email.ts
@@ -1,3 +1,4 @@
+import { decodeHTML } from "entities";
 import nodemailer from "nodemailer";
 import { z } from "zod";
 
@@ -40,7 +41,7 @@ export default class BaseEmail {
     const parseSubject = z.string().safeParse(payload?.subject);
     const payloadWithUnEscapedSubject = {
       ...payload,
-      ...(parseSubject.success && { subject: decodeURIComponent(parseSubject.data) }),
+      ...(parseSubject.success && { subject: decodeHTML(parseSubject.data) }),
     };
 
     new Promise((resolve, reject) =>