0

When sending emails in the context of an application that will send transactional or marketing emails, sometimes you want to include user-provided information in the body, like for example you ask the user for their name and you send an email with "Hi ${user_name}, ...".

An attacker could say their name is https://evil.com and my emails now contain links to a malicious site. Yay!

However, I'm wondering why this happens. When sending HTML-based email, I'm sending this as text (in a p or div or something), not as a hyperlink. But email clients seem to ignore this and convert anything that looks like a link into a link. I checked the received email source, and it's definitely not a link.

So I'm wondering:

  • Why do email clients do this? I guess for usability, but doesn't this put their users at risk? I would say if email senders want to make something a link, they will.
  • Is there some way to tell the email recipient "no, this is definitely not a link"?
1
  • You should still sanitize the ${user_name} before using it in the message... Oct 21, 2023 at 6:09

1 Answer 1

2

Why do email clients do this? I guess for usability,

Exactly.

but doesn't this put their users at risk?

Also true. It is a common pattern that better usability comes with weakened security and that hardening security impacts usability. So there is always a trade-off.

I would say if email senders want to make something a link, they will.

Don't overestimate the senders and the capabilities of their mail clients. First, explicitly inserting a link is only possible for HTML-Mails, which while common is not always the default setting.

Then, manually inserting a link by the sender requires both effort and knowledge on how to do it. What might to simple to grasp for a 20 year old isn't that easy for a 70 year old. And users are also lazy (or efficient depending on the point of view). Some mail clients will automatically detect links in the inserted text and convert them to "real" links in order to help the users, but not all do.

Is there some way to tell the email recipient "no, this is definitely not a link"?

No definite way. Often the link is simply changed in order to not trigger the rewrite heuristics, like writing xttps:// instead of https://

2
  • I would understand this behavior in plain-text email (even if there's an RFC on how to specify something is a link). Also, things like "google.com" may trigger this behavior, even without http(s):// prefix.
    – gimix
    Oct 20, 2023 at 12:43
  • @gimix: Plain text is simple text which unlike HTML has no defined markup for structured elements, which also means no way of explicitly specifying what a link is and what not a link is. That's what was used traditionally in mails. Use of HTML in mails came later. And while it is widely supported it is not always the default, sometimes to prevent web-bugs (i.e. tracking if a mail was received and read with referenced images or similar). Oct 20, 2023 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .