@@ -490,31 +490,54 @@ describe(
490490var message = getLocationMessage(defaultLocation)
491491message.uaBrowser = 'Firefox'
492492message.uaOS = 'BeOS'
493+message.uaOSVersion = '1.0'
493494494495mailer.mailer.sendMail = function (emailConfig) {
495-assert.ok(includes(emailConfig.html, 'Firefox on BeOS'))
496-assert.ok(includes(emailConfig.text, 'Firefox on BeOS'))
496+assert.ok(includes(emailConfig.html, 'Firefox on BeOS 1.0'))
497+assert.ok(includes(emailConfig.text, 'Firefox on BeOS 1.0'))
497498}
498499mailer[type](message)
499500}
500501)
501502502-it(
503-'device name gets HTML-escaped for ' + type,
504-function () {
505-var message = getLocationMessage(defaultLocation)
506-message.uaBrowser = 'Firefox <a>Link</a>'
503+it(`drops dodgy-looking uaBrowser property for ${type}`, () => {
504+const message = getLocationMessage(defaultLocation)
505+message.uaBrowser = '<a>Firefox</a>'
506+message.uaOS = 'Android'
507507508-mailer.mailer.sendMail = function (emailConfig) {
509-assert.ok(! includes(emailConfig.html, '<a>Link</a>'))
510-assert.ok(! includes(emailConfig.text, '<a>Link</a>'))
511-assert.ok(includes(emailConfig.html, 'Firefox <a>Link</a>'))
512-assert.ok(includes(emailConfig.text, 'Firefox <a>Link</a>'))
513-}
514-mailer[type](message)
508+mailer.mailer.sendMail = emailConfig => {
509+assert.ok(! includes(emailConfig.html, '<a>Firefox</a> on Android'))
510+assert.ok(includes(emailConfig.html, 'Android'))
511+assert.ok(! includes(emailConfig.text, '<a>Firefox</a> on Android'))
512+assert.ok(includes(emailConfig.text, 'Android'))
515513}
516-)
514+mailer[type](message)
515+})
517516517+it(`drops dodgy-looking uaOS property for ${type}`, () => {
518+const message = getLocationMessage(defaultLocation)
519+message.uaBrowser = 'Firefox'
520+message.uaOS = 'http://example.com'
521+522+mailer.mailer.sendMail = emailConfig => {
523+assert.ok(! includes(emailConfig.html, 'http://example.com'))
524+assert.ok(! includes(emailConfig.text, 'http://example.com'))
525+}
526+mailer[type](message)
527+})
528+529+it(`drops dodgy-looking uaOSVersion property for ${type}`, () => {
530+const message = getLocationMessage(defaultLocation)
531+message.uaBrowser = 'Firefox'
532+message.uaOS = 'Android'
533+message.uaOSVersion = 'dodgy-looking'
534+535+mailer.mailer.sendMail = emailConfig => {
536+assert.ok(! includes(emailConfig.html, 'dodgy-looking'))
537+assert.ok(! includes(emailConfig.text, 'dodgy-looking'))
538+}
539+mailer[type](message)
540+})
518541}
519542520543if (type === 'verifyLoginEmail') {