Enhance email preview with external link handling and iframe support - #7
Enhance email preview with external link handling and iframe support#7projecthanif wants to merge 1 commit into
Conversation
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6037506bf2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| no allow-popups): the email HTML is untrusted and can't touch the app's cookies/DOM | ||
| or navigate/pop out on its own — it can only ask the parent (via the interceptor | ||
| script above) to hand a link off to the OS browser. --}} | ||
| <iframe srcdoc="{{ $previewHtml }}" class="ev-iframe" sandbox="allow-scripts" |
There was a problem hiding this comment.
When an HTML email contains a script that calls parent.postMessage({nativemailerPreview: true, url: 'https://…'}, '*'), this permission executes it immediately when the preview loads. The source check cannot distinguish that untrusted script from the injected interceptor because both run in the same iframe, so an attacker can invoke Shell::openExternal() without a click or repeatedly launch URLs and protocol handlers; keep untrusted scripts disabled or remove all executable email content before granting allow-scripts.
Useful? React with 👍 / 👎.
This pull request improves the handling of external links in the email HTML preview, ensuring that clicking links inside the sandboxed iframe opens them in the user's default browser rather than inside the app. It also updates the test email script to include an external link for easier testing.
External link handling improvements:
email-html-view.blade.php) that captures clicks on external links (http(s),mailto,tel), prevents default navigation, and sends the URL to the parent window viapostMessage.sandboxattribute to allow scripts (but not navigation or same-origin access), and injects the interceptor script into the rendered HTML.postMessageevent and call a Livewire method to open the link externally.Backend support for external link opening:
openExternalLinkLivewire method inViewEmail.php, which validates the URL scheme and uses the OS shell to open the link in the default browser. [1] [2]Test email update:
send_test_email.pyto include an external link in both the plain text and HTML parts of the test email, making it easier to verify the new link handling behavior. [1] [2]