search

yourtempo / tempo-email-parser

MIT License
132 stars 14 forks source link

Sanitizing HTML #11

Closed Soreine closed 4 years ago

Soreine commented 4 years ago

See #7

Soreine commented 4 years ago

Actually, I realized that we do not need to use DOMPurify.

What we need is just to protect from XSS

Since emails are static HTML, we can protect from XSS by disabling JavaScript execution, and displaying the email in a sandbox environment.

DOMPurify is made to sanitize HTML that is run in a JS-enabled context. So it is extremely restrictive in order to be safe. For example, it removes <link> and <meta> tags, which we need to display emails correctly, but could be used to inject scripts. I initially started to write exceptions, but then it becomes insecure because we cannot reasonably manage all security issues that could arise from them.