search

FelixSchwarz / mjml-python

Python implementation for MJML - a framework that makes responsive-email easy
MIT License
73 stars 16 forks source link

escaped HTML entities like `>` were unescaped in the final mjml output #54

Closed FelixSchwarz closed 5 months ago

FelixSchwarz commented 5 months ago

Fixes #52

@sh-at-cs, @caseyjhol: In the end I went for a really narrow unescaping implementation. By doing so I hope that there are fewer potential security issues (who knows what obscure features CSS has/will get?). Do you think that this minimal implementation is good as well?

caseyjhol commented 5 months ago

Nice! I think this is a good solution. Thanks for the quick turnaround, and apologies for overlooking this in the first place.

caseyjhol commented 5 months ago

Do we want to consider releasing this as a patch instead of a minor release?

FelixSchwarz commented 5 months ago

apologies for overlooking this in the first place.

No worries, I did the same mistake back then.

Do we want to consider releasing this as a patch instead of a minor release?

I think this is a pretty security major issue given the possibility that untrusted users might heavily rewrite the structure of emails sent through a web platform. Therefore I'd prefer putting this out as a "minor" release.