5 ms·

I see that some of the email clients mentioned wrap the mail’s content in extra HTML tags and modify the CSS and classes names. I’m wondering why email clients

I see that some of the email clients mentioned wrap the mail’s content in extra HTML tags and modify the CSS and classes names. I’m wondering why email clients don’t use sandboxed iframes to render HTML email? Do they still present security risks?

red_trumpet 3y ago
The extra HTML does not happen from the client reading the forwarded email, but when forwarding. That is expected, because the forwarding party might want to add more text to the email.
- echoangle 3y ago
  At least the person forwarding the mail could check the preview and see that the text changed.
  - raptor99 3y ago
    Did you see the GMail section at the bottom of the article?
    - echoangle 3y ago
      No, I started skimming before that point, thanks for pointing that out. I guess you have to check your sent mails now after sending one, until this is fixed
  - deleted 3y ago
    [deleted]
Savageman 3y ago
In the past I had issues using iframes. Not for rendering or security issue (those work great in my memory). But if your email has a link to your website, and your sandbox iframe disallow Javascript, then this "security context" is carried over to the page that was opened from clicking the link inside the iframe, and you website cannot use JS. [edit] The solution was "allow-popups-to-escape-sandbox", so I see no reason it would not work.