4 ms·

Hmmm. I did actually look at using wkhtmltopdf for another project so I'm sort of familiar with it at least. I do definitely see the concerns here, but I've no

Hmmm. I did actually look at using wkhtmltopdf for another project so I'm sort of familiar with it at least. I do definitely see the concerns here, but I've not been able to think of a good way of handling them. I'm not sure how user friendly a pdf download would be. Chromium at least doesn't display them inline, so you'd have to view the email, get prompted to save it to disk, and then open it up using a pdf viewer... Do you think stripping out all the JS tags from the email before rendering it would be a safe enough solution?

mike-cardwell 15y ago
There are so many different ways of executing script. Just stripping out script tags isn't really enough. Here's another example which I've just tested with your service and works: <img src="#" onerror="alert('XSS')"> It's also possible to use SVG images with embedded javascript. You could generate a PNG from the PDF and display that inline in the page. You could then have a "(PDF Version with Clickable links)" link next to it?
- davesmylie 15y ago
  That sounds more usable. I'll have a look into implementing that. Thanks heaps =)