feat: add quote text, remove risky style tag#1672
Conversation
WalkthroughThe update modifies the email HTML sanitizer by removing the 'style' tag from allowed tags and adds a function to wrap quoted email sections (like blockquotes and Gmail quotes) in collapsible elements with a "Show quoted text" summary. Inline CSS is used to style these collapsible sections, adapting to light or dark themes. Additionally, the mail content container's CSS overflow behavior is changed from hidden to scroll. Changes
Sequence Diagram(s)sequenceDiagram
participant EmailHTML as Raw Email HTML
participant Sanitizer as HTML Sanitizer
participant Processor as Email Processor
participant Output as Processed HTML
EmailHTML->>Sanitizer: Remove disallowed tags (including 'style')
Sanitizer->>Processor: Sanitized HTML
Processor->>Processor: collapseQuoted() wraps blockquotes/gmail_quote in <details>
Processor->>Output: Final processed HTML with collapsible quoted text
Possibly related PRs
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/server/src/lib/email-processor.ts (1)
115-116: Consider adding error handling for selector operations.The function calls could potentially fail if the DOM structure is malformed. Consider wrapping these calls in try-catch blocks to prevent the entire email processing from failing due to quote processing errors.
-collapseQuoted('blockquote'); -collapseQuoted('.gmail_quote'); +try { + collapseQuoted('blockquote'); + collapseQuoted('.gmail_quote'); +} catch (error) { + console.warn('Failed to collapse quoted text:', error); +}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
apps/server/src/lib/email-processor.ts(3 hunks)
🔇 Additional comments (2)
apps/server/src/lib/email-processor.ts (2)
17-17: Excellent security improvement!Removing the 'style' tag from allowed HTML tags is a significant security enhancement that prevents potential XSS attacks through malicious CSS injection while maintaining necessary styling capabilities through the
allowedStylesconfiguration.
189-206: Well-structured CSS with proper theme support.The CSS styling is well-implemented with:
- Proper theme-based color adaptation
- Good accessibility considerations (hiding default markers, proper cursor styling)
- Consistent spacing and visual hierarchy
The implementation correctly handles both light and dark themes while maintaining good UX.
…e email HTML processing by allowing additional HTML tags in sanitizer.
4 participants
also removes the style tag from allowedTags which is risky
Summary by CodeRabbit
New Features
Style