Hacker News Reader

I see that some of the email clients mentioned wrap the mail’s content in extra HTML tags and modify the CSS and classes names. I’m wondering why email clients don’t use sandboxed iframes to render HTML email? Do they still present security risks?

View on HN

The extra HTML does not happen from the client reading the forwarded email, but when forwarding. That is expected, because the forwarding party might want to add more text to the email.

At least the person forwarding the mail could check the preview and see that the text changed.

Did you see the GMail section at the bottom of the article?

No, I started skimming before that point, thanks for pointing that out. I guess you have to check your sent mails now after sending one, until this is fixed

In the past I had issues using iframes. Not for rendering or security issue (those work great in my memory). But if your email has a link to your website, and your sandbox iframe disallow Javascript, then this "security context" is carried over to the page that was opened from clicking the link inside the iframe, and you website cannot use JS.

[edit] The solution was "allow-popups-to-escape-sandbox", so I see no reason it would not work.

Reply on news.ycombinator.com