From 1958d0db6336915e6b3c6854310cd9a5e39432b7 Mon Sep 17 00:00:00 2001
From: Simon Backx <simon@ghost.org>
Date: Fri, 2 Dec 2022 10:49:01 +0100
Subject: [PATCH] Removed spaces and quotes from replacement ids (#15921)

fixes https://github.com/TryGhost/Team/issues/2350
---
 ghost/email-service/lib/email-renderer.js       | 11 +++++++++++
 ghost/email-service/test/email-renderer.test.js |  6 +++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/ghost/email-service/lib/email-renderer.js b/ghost/email-service/lib/email-renderer.js
index dcb0f45bcc..dea4c0126c 100644
--- a/ghost/email-service/lib/email-renderer.js
+++ b/ghost/email-service/lib/email-renderer.js
@@ -384,6 +384,7 @@ class EmailRenderer {
                 if (definition) {
                     replacements.push({
                         id: replacementStr,
+                        originalId: recipientProperty,
                         token: new RegExp(escapeRegExp(replacementMatch), 'g'),
                         getValue: fallback ? (member => definition.getValue(member) || fallback) : definition.getValue
                     });
@@ -391,6 +392,16 @@ class EmailRenderer {
             }
         }
 
+        // Now loop any replacements with possible invalid characters and replace them with a clean id
+        let counter = 1;
+        for (const replacement of replacements) {
+            if (replacement.id.match(/[^a-zA-Z0-9_]/)) {
+                counter += 1;
+                replacement.id = replacement.originalId + '_' + counter;
+            }
+            delete replacement.originalId;
+        }
+
         return replacements;
     }
 
diff --git a/ghost/email-service/test/email-renderer.test.js b/ghost/email-service/test/email-renderer.test.js
index 97255a14c6..208a332f85 100644
--- a/ghost/email-service/test/email-renderer.test.js
+++ b/ghost/email-service/test/email-renderer.test.js
@@ -56,7 +56,7 @@ describe('Email renderer', function () {
             const replacements = emailRenderer.buildReplacementDefinitions({html, newsletter});
             assert.equal(replacements.length, 1);
             assert.equal(replacements[0].token.toString(), '/%%\\{first_name, "there"\\}%%/g');
-            assert.equal(replacements[0].id, 'first_name, "there"');
+            assert.equal(replacements[0].id, 'first_name_2');
             assert.equal(replacements[0].getValue(member), 'Test');
 
             // In case of empty name
@@ -68,14 +68,14 @@ describe('Email renderer', function () {
             const replacements = emailRenderer.buildReplacementDefinitions({html, newsletter});
             assert.equal(replacements.length, 3);
             assert.equal(replacements[0].token.toString(), '/%%\\{first_name, "there"\\}%%/g');
-            assert.equal(replacements[0].id, 'first_name, "there"');
+            assert.equal(replacements[0].id, 'first_name_2');
             assert.equal(replacements[0].getValue(member), 'Test');
 
             // In case of empty name
             assert.equal(replacements[0].getValue({name: ''}), 'there');
 
             assert.equal(replacements[1].token.toString(), '/%%\\{first_name, "member"\\}%%/g');
-            assert.equal(replacements[1].id, 'first_name, "member"');
+            assert.equal(replacements[1].id, 'first_name_3');
             assert.equal(replacements[1].getValue(member), 'Test');
 
             // In case of empty name