Encoding HTML email content

Question

Say I have a form on my website.

The input elements of the form are: email address, name and some feedback textarea.

The server-side application that this form is submitted to will send an HTML content-type email to the email address you specify supplying all the input fields you specified.

For instance

Hi {Name},

Thanks for your feedback. Your feedback was: {Feedback}

The email you provided is: {Email}

My question is:

Should I encode the {Name} and {Feedback} variables in the email? Given the fact that no current modern email client or web mail interface will run any script or load external resources by default?

The reason I ask is because I reported such an "issue" to a very big public company. The security engineer I talked to, told me that they don't worry about such things, and these kind of things are expected to happen.

He suggested that it's the user's fault for not using a more secure client (if the client executes the javascript).

Thanks.

Answer 1

Should I encode the {Name} and {Feedback} variables in the email?

Yes - for correctness, even if there is no practical threat. If the feedback-giver includes a less-than sign in their feedback, it should appear in the mail as a less-than-sign, and not get treated as part of a markup tag. Handle text context injection correctly, get the security piece for free.

Attacks using HTML injection are much more limited in mail than on a web page because it is assumed that there is no origin associated with the sender that can be usurped to get cross-site-scripting, if scripting executes at all.

However it's not just JavaScript: markup injection would still get you the ability to reformat the mail in general. For example you could inject a spoofed link into what looks like the sender-specified part of the mail, or some styled markup to overlay custom content over the whole mail body. Depending on who the Big Public Company are there might be an increased phishing risk here.