I am writing a simple webmail where I want (obviously) to display the emails.
I’m wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a <div> a security risk?
I’m guessing that yes since the email could contain anything (could it contain Javascript?). But then how should I proceed? How do other webmails do?
I’m thinking that stripping dangerous HTML tags would be a bad solution since it’s impossible to think of all the cases.
4
Yes it is insecure and problematic in many ways:
- JavaScript inside the mail could hijack the session (XSS) or do other things
- CSS in the mail could break your layout
- Images and other resources loaded from remote sites can e used for tracking and thus have privacy issues
- Links in mails might carry private info in the referrer
Filtering against these things is actually the key trouble for a web mailer. Filtering is not easy as you not only have to filter out <script> tags but also a bunch of attributes (like javascript event handlers)
A plain whitelist will break too many mails, though.
What you need is to collect a huge amount of sample mails from different sources and see what elements they actually need and provide these.
6
The basic problem is that you are asking the end user to place the same trust they give your web domain to the content of the HTML email, the content of which, you have limited control over.
The only safe way that I know for sure is reliable is to strip the HTML email down to pure and simple text and text formatting options such as p, em tags. Although this is hardly what people would consider HTML email.
Start allowing anything beyond presentational tags and you are making assumptions that you know more about how these tags can be misused than the mal-ware writers. And believe me, that is a brave claim for anyone to make.