4 ms·
JMAP is not JavaScript embedded in email. Are you thinking of something else?
by Flimm 4y ago
JMAP is not JavaScript embedded in email. Are you thinking of something else?
- egberts1 4y agoBut it does nothing to prevent JS in its payload.
- Beltalowda 4y agoI can also put JavaScript in a DNS TXT record; the protocol does nothing to stop that! There is no "JavaScript" in JMAP in the sense that it's supported by the protocol, and the specification explicitly warns against email clients interpreting JavaScript.
- egberts1 4y agoNow you are getting the idea of how to design a new network protocol in contrast to adding the supporting numbers of parsers and validators. Potential and actual vulnerabilities explodes, like the chronic problems of Microsoft Macros.
- windows_sucks 4y agothe client should be responsible for not executing embedded JS in a message
- sleepybrett 4y agosure, but that's not a feature a protocol should have. Because the protocol itself does not interact with it in any way. It's clients that process that javascript and execute it. The protocol is about moving 'emails' from one place to another. If you don't want javascript in your email and run your own email stack you can certainly filter out javascript blobs if you want. Or you can chose clients that disable or simply don't even know what javascript is.
- egberts1 4y agoWhile it is a bit late to close the door on JS usage within SMTP protocol, choices of client SMTP becomes paramount given its legacy stage of SMTP protocol.
- sleepybrett 4y agoagain, the protocol should be dumb, its a way to move bytes. If there is js encoded in those bytes the rotocol will not and should not know or care. It's up to a client do decide what it wants to do with the bytes it receives.