escape email variables

lib/replace_email_variables.rb

@@ -26,6 +26,8 @@ module ReplaceEmailVariables
   DOCUMENTS_LINKS = /\{+documents\.links\}+/i
   DOCUMENTS_LINK = /\{+documents\.link\}+/i
 
+  ESCAPED_BRACES = "\u{E000}\u{E001}"
+
   EMAIL_HOST = ENV.fetch('EMAIL_HOST', nil)
 
   module_function
@@ -86,7 +88,11 @@ module ReplaceEmailVariables
       build_submitters_n_field(submitter.submission, index, :values, match[:field_name].to_s.strip)
     end
 
-    replace(text, SENDER_EMAIL, html_escape:) { submitter.submission.created_by_user&.email.to_s.sub(/\+\w+@/, '@') }
+    text = replace(text, SENDER_EMAIL, html_escape:) do
+      submitter.submission.created_by_user&.email.to_s.sub(/\+\w+@/, '@')
+    end
+
+    text.tr(ESCAPED_BRACES, '{}')
   end
   # rubocop:enable Metrics
 
@@ -136,10 +142,12 @@ module ReplaceEmailVariables
 
   def replace(text, var, html_escape: false)
     text.gsub(var) do
+      value = yield(Regexp.last_match).to_s.tr('{}', ESCAPED_BRACES)
+
       if html_escape
-        ERB::Util.html_escape(yield(Regexp.last_match))
+        ERB::Util.html_escape(value)
       else
-        yield(Regexp.last_match)
+        value
       end
     end
   end