fix: allow <style> and essential attributes in sanitizer#1648
fix: allow <style> and essential attributes in sanitizer#1648MrgSub merged 3 commits intoMail-0:stagingfrom
Conversation
|
""" WalkthroughThe sanitization configuration for processing email HTML was updated to allow more tags and attributes. The 'style' tag is now permitted, and a detailed whitelist of allowed attributes and styles was introduced for various tags. No changes were made to function signatures or exported entities. Changes
Possibly related PRs
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
Modified email HTML sanitization to improve email rendering compatibility while maintaining security measures in apps/server/src/lib/email-processor.ts.
- Added support for
<style>tags and essential HTML attributes to fix broken email rendering - Configured granular attribute allowlisting for specific HTML elements to maintain security
- Enabled CSS style validation through regex pattern matching
- Images and links remain secured through existing sanitization controls
1 file reviewed, 1 comment
Edit PR Review Bot Settings | Greptile
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
apps/server/src/lib/email-processor.ts(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
apps/server/src/lib/email-processor.ts (1)
Learnt from: retrogtx
PR: Mail-0/Zero#1468
File: apps/server/src/trpc/routes/mail.ts:386-391
Timestamp: 2025-06-27T04:59:29.731Z
Learning: In apps/server/src/trpc/routes/mail.ts, the attachment processing logic conditionally handles mixed attachment types - it preserves existing File-like objects with arrayBuffer methods while only converting serialized attachments that need processing through toAttachmentFiles.
🔇 Additional comments (3)
apps/server/src/lib/email-processor.ts (3)
17-17: Consider the security implications of allowing<style>tags.While allowing
<style>tags may be necessary for proper email rendering, it introduces potential security risks including CSS injection attacks and data exfiltration through CSS. Consider implementing additional CSS content validation if not already present.
19-34: Good security practice using attribute whitelist.The change from disallowing all attributes to using a specific whitelist is a good security practice. The selected attributes are commonly needed for email HTML rendering and are generally safe.
48-48: Minor formatting improvement.Good addition of trailing comma for consistency.
2 participants
before:
after:
Summary by CodeRabbit
New Features
Bug Fixes