# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: ruby
# expected: ActionMailer HTML email built with unescaped user content

class NotificationMailer < ApplicationMailer
  def welcome_email(user, custom_message)
    @user    = user
    @message = custom_message
    @subject = params[:subject] || "Welcome!"

    mail(
      to:      @user.email,
      subject: @subject
    ) do |format|
      format.html { render html: "<h1>#{@user.name}</h1><p>#{@message}</p>".html_safe }
    end
  end
end