3 ms·

Allowing style to be included in a web based email client is just asking for trouble. It's not just hard. It's close to impossible thanks to CSS global nature.

by zaphar 11y ago

Allowing style to be included in a web based email client is just asking for trouble. It's not just hard. It's close to impossible thanks to CSS global nature. You would have to literally parse out the css and rewrite it as well as all the html content to automatically uniquely namespace it so it doesn't collide with the rest of your page. And meanwhile you've just created a new attack vector for your email service with security implications you may not want to take on. All of that just so that you can pretend an inherently text medium is actually a way to deliver web pages directly to users. This is a lot of work for questionable benefit to GMail's actual users as opposed to Email Marketers.

mschuster91 11y ago
There's this thing called "iframes" with an attribute called "sandbox". And to prevent tracking or other cruft with images or external content, well, writing a CSS filter (url:... values) and filtering out src="" attributes in the HTML is not THAT hard. There is no valid reason anymore for not iframe'ing your HTML emails any more. Browsers are consistent enough in rendering that you can achieve trivial cross-platform pixel perfection (font rendering aside).
jkturbo 11y ago
I'm the author of the article. All the other web mail clients from Yahoo! Mail, Outlook.com, Comcast and so forth support the style tag. If it was a big security attack vector, all those clients wouldn't be doing that. The other webmails rewrite ids and classes and prepend unique identifiers to prevent them from clashing with their own namespace (AOL is the only one that puts it in an iframe). Interestingly Gmail webmail actually supports the style tag but strips out id and class selectors in them leaving element selectors - so they're actually doing some heavy duty parsing already. As for it being an inherently text medium. I would say it depends on the recipient. Emails do not need to be web pages, but simple CSS styling can go a long way to ease readability in emails - especially in a long curated newsletter like Product Hunt.

by zaphar 11y ago

mschuster91 11y ago

There's this thing called "iframes" with an attribute called "sandbox". And to prevent tracking or other cruft with images or external content, well, writing a CSS filter (url:... values) and filtering out src="" attributes in the HTML is not THAT hard. There is no valid reason anymore for not iframe'ing your HTML emails any more. Browsers are consistent enough in rendering that you can achieve trivial cross-platform pixel perfection (font rendering aside).

jkturbo 11y ago

I'm the author of the article. All the other web mail clients from Yahoo! Mail, Outlook.com, Comcast and so forth support the style tag. If it was a big security attack vector, all those clients wouldn't be doing that. The other webmails rewrite ids and classes and prepend unique identifiers to prevent them from clashing with their own namespace (AOL is the only one that puts it in an iframe). Interestingly Gmail webmail actually supports the style tag but strips out id and class selectors in them leaving element selectors - so they're actually doing some heavy duty parsing already. As for it being an inherently text medium. I would say it depends on the recipient. Emails do not need to be web pages, but simple CSS styling can go a long way to ease readability in emails - especially in a long curated newsletter like Product Hunt.