Email Content Sanitization

Relevant source files

The following files were used as context for generating this wiki page:

• crates/mailiner-html/src/lib.rs
• crates/mailiner-app/src/formatter/html.rs
• crates/mailiner-html/src/css.rs
• crates/mailiner-app/src/formatter/sanitize.rs
• crates/mailiner-composer/src/export.rs
• crates/mailiner-app/src/formatter/mod.rs

Email Content Sanitization protects users by stripping malicious or privacy-invasive content from emails before they are displayed or sent. The system prevents JavaScript execution, blocks remote resource tracking, and filters potentially dangerous HTML tags and attributes. This functionality is shared across the message viewer and the message composer to ensure consistent security policies throughout the application.

Sources: crates/mailiner-html/Cargo.toml, crates/mailiner-html/src/lib.rs:1-5

Core Sanitization Architecture

The sanitization system relies on the ammonia crate to clean HTML fragments and custom regex-based filters for CSS and specific attribute processing. The architecture distinguishes between viewing an email and preparing an email for export.

Sanitization Workflow

The system processes content based on three primary scenarios:

1. Viewer Policy: Used when displaying incoming messages. It focuses on blocking remote resources by default and resolving cid: references to local data URLs.
2. Edit Policy: Used in the composer for contenteditable areas. It allows blob: and data: URLs for local image previews.
3. Export Policy: Used before sending an email. It ensures only cid: references remain and strips internal application markers like data-mlnr-*.

Sources: crates/mailiner-html/src/lib.rs:75-103, crates/mailiner-app/src/formatter/html.rs:31-45, crates/mailiner-composer/src/export.rs:200-215

HTML Sanitization Policies

Sanitization applies strict allowlists for tags and attributes. The ammonia builder is configured to remove dangerous tags like <script>, <iframe>, and <object> along with their contents.

Tag and Attribute Filtering

Category	Filter Rule	Sources
Banned Tags	script, style, iframe, object, embed, svg, math	crates/mailiner-html/src/lib.rs:114-118
Allowed Tags	p, div, span, blockquote, pre, ul, ol, li, a, img, h1-h6, table, tr, td	crates/mailiner-html/src/lib.rs:48-70
Global Attributes	class, id, style, width, height, align, bgcolor	crates/mailiner-app/src/formatter/html.rs:141-158
URL Schemes	http, https, mailto, cid, blob, data	crates/mailiner-html/src/lib.rs:136-138

The ammonia_clean function in the app formatter specifically adds support for presentational attributes common in legacy HTML emails, such as cellpadding and valign.

Sources: crates/mailiner-app/src/formatter/html.rs:163-176, crates/mailiner-html/src/lib.rs:141-160

CSS and Style Sanitization

The system sanitizes CSS within <style> blocks and inline style attributes. It removes directives that could execute code or bypass security boundaries.

The sanitize_css function performs the following actions:

• Removes @import rules to prevent external stylesheet loading.
• Strips expression(...), -moz-binding, and behavior to block legacy script execution in CSS.
• Filters url() values based on the allow_remote_resources configuration.

Sources: crates/mailiner-html/src/css.rs:25-56, crates/mailiner-app/src/formatter/sanitize.rs:27-66

Resource Management

The sanitizer identifies and manages three types of resources: remote, embedded (data:), and linked (cid:).

Image Safety

Only specific raster image MIME types are considered safe. SVG and MathML are explicitly removed or blocked due to potential XSS vectors within their XML structures.

Supported Safe Image Types:

• image/png
• image/jpeg
• image/jpg
• image/gif
• image/webp
• image/bmp

Sources: crates/mailiner-html/src/lib.rs:11-18, crates/mailiner-app/src/formatter/html.rs:111-115

CID Resolution

During message viewing, the format_html function resolves cid: (Content-ID) references. It searches the message parts for a matching ID and converts the binary content into a base64-encoded data: URL for safe rendering.

Configuration Options

Sanitization behavior is controlled via the FormatOptions structure.

Option	Type	Default	Description
allow_remote_resources	bool	false	If false, strips http(s) URLs from src, srcset, and CSS url().

When allow_remote_resources is false, the system sets a prevented_remote_resources flag in the FormatResult. This allows the UI to notify the user that content was blocked for privacy.

Sources: crates/mailiner-app/src/formatter/mod.rs:12-25, crates/mailiner-app/src/formatter/html.rs:37-45

Export Sanitization

When exporting a draft to a MIME message, the system applies the Export policy. This is the final stage before a message is serialized into the RFC 822 format.

1. Tag Cleaning: Invokes ammonia with the Export policy.
2. Attribute Stripping: Uses regex to remove application-internal attributes like data-mlnr-quote and data-mlnr-id.
3. Scheme Enforcement: Only cid: schemes are allowed for images; blob: and data: URLs are stripped because they must be converted to attachments/inlines before this stage.

Sources: crates/mailiner-html/src/lib.rs:100-104, crates/mailiner-html/src/lib.rs:163-168, crates/mailiner-composer/src/export.rs:208-212

Summary

Email Content Sanitization in Mailiner provides a multi-layered defense against web-based attacks in emails. By centralizing policies in the mailiner-html crate and applying them during viewing, editing, and exporting, the project ensures that privacy is maintained (by blocking remote resources) and security is enforced (by stripping active content). The system's ability to resolve CIDs into local data URLs allows rich media display without compromising the security of the host application.