@bobfrankston/mailx-types 0.1.13 → 0.1.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/index.js +15 -0
- package/package.json +1 -1
package/index.js
CHANGED
|
@@ -80,6 +80,21 @@ export function sanitizeHtml(html) {
|
|
|
80
80
|
return `url("") /* blocked: ${url} */`;
|
|
81
81
|
});
|
|
82
82
|
clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
|
|
83
|
+
// Strip every interactive form element. Even without the surrounding
|
|
84
|
+
// <form>, an <input type="password"> in an email body is dangerous —
|
|
85
|
+
// WebView2's password manager offers to autofill it, and the user
|
|
86
|
+
// might type a real password into what looks like an in-email control.
|
|
87
|
+
// Same for <textarea>, <select>/<option>, and <button>. Bob 2026-05-14:
|
|
88
|
+
// observed a phishing-shaped "CHANGE YOUR PASSWORD" email rendering
|
|
89
|
+
// with working input fields + the OS autofill chip. Replace with a
|
|
90
|
+
// visible "[blocked: input]" marker so the user sees something was
|
|
91
|
+
// stripped (a silent removal would hide the phishing attempt entirely
|
|
92
|
+
// — they'd think "this email is just text" when it actually tried to
|
|
93
|
+
// capture credentials).
|
|
94
|
+
clean = clean.replace(/<input\b[^>]*\/?>/gi, "[blocked: form input]");
|
|
95
|
+
clean = clean.replace(/<textarea\b[^>]*>[\s\S]*?<\/textarea>/gi, "[blocked: textarea]");
|
|
96
|
+
clean = clean.replace(/<select\b[^>]*>[\s\S]*?<\/select>/gi, "[blocked: select]");
|
|
97
|
+
clean = clean.replace(/<button\b[^>]*>([\s\S]*?)<\/button>/gi, "$1");
|
|
83
98
|
clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
|
|
84
99
|
return { html: clean, hasRemoteContent };
|
|
85
100
|
}
|