Fix displayname not being html-escaped in relay mode templates

config/bridge.go

@@ -283,8 +283,8 @@ func (rc *RelaybotConfig) UnmarshalYAML(unmarshal func(interface{}) error) error
 }
 
 type Sender struct {
-	UserID id.UserID
-	*event.MemberEventContent
+	UserID string
+	event.MemberEventContent
 }
 
 type formatData struct {
@@ -293,11 +293,15 @@ type formatData struct {
 	Content *event.MessageEventContent
 }
 
-func (rc *RelaybotConfig) FormatMessage(content *event.MessageEventContent, sender id.UserID, member *event.MemberEventContent) (string, error) {
+func (rc *RelaybotConfig) FormatMessage(content *event.MessageEventContent, sender id.UserID, member event.MemberEventContent) (string, error) {
+	if len(member.Displayname) == 0 {
+		member.Displayname = sender.String()
+	}
+	member.Displayname = template.HTMLEscapeString(member.Displayname)
 	var output strings.Builder
 	err := rc.messageTemplates.ExecuteTemplate(&output, string(content.MsgType), formatData{
 		Sender: Sender{
-			UserID:             sender,
+			UserID:             template.HTMLEscapeString(sender.String()),
 			MemberEventContent: member,
 		},
 		Content: content,

portal.go

@@ -1847,15 +1847,15 @@ type MediaUpload struct {
 
 func (portal *Portal) addRelaybotFormat(sender *User, content *event.MessageEventContent) bool {
 	member := portal.MainIntent().Member(portal.MXID, sender.MXID)
-	if len(member.Displayname) == 0 {
-		member.Displayname = string(sender.MXID)
+	if member == nil {
+		member = &event.MemberEventContent{}
 	}
 
 	if content.Format != event.FormatHTML {
 		content.FormattedBody = strings.Replace(html.EscapeString(content.Body), "\n", "<br/>", -1)
 		content.Format = event.FormatHTML
 	}
-	data, err := portal.bridge.Config.Bridge.Relay.FormatMessage(content, sender.MXID, member)
+	data, err := portal.bridge.Config.Bridge.Relay.FormatMessage(content, sender.MXID, *member)
 	if err != nil {
 		portal.log.Errorln("Failed to apply relaybot format:", err)
 	}