search

mailhog / MailHog

Web and API based SMTP testing
MIT License
13.99k stars 1.06k forks source link

Cross-Site Scripting in HTML view #321

Open sectestaccount opened 4 years ago

sectestaccount commented 4 years ago

Hi,

is it possible to disable JavaScript in HTML view? It is possible to perform Cross-Site Scripting attacks: https://owasp.org/www-community/attacks/xss/

image

The issue might happen because of this line: https://github.com/mailhog/MailHog-UI/blob/master/web/web.go#L104

Thanks. Kind regards.

mailukas commented 2 years ago

I just ran into this issue. It's still unfixed.

I don't think any mail view or mail client should execute JavaScript at all. :-/