I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting?

In gmail, when I receive some emails from, lets say, twitter, they are nicely formatted. I'm after something like this.

Html5 supports sandbox attribute for iframes, which seems to solve my problem, but it's badly supported. I need a solution which works in MODERN browsers, but which doesn't become insecure in old browsers. It is acceptable for this NOT TO WORK at all in old browsers, but it cannot become insecure. It should work in IE9 and above.

What are my options?

2 Answers 2


Google spends a lot of money each year in bug bounty to ensure that Gmail isn't susceptible to XSS. Part of this effort has produced Google-Caja, which is an open source project that filters HTML to a "safe" subset.

HTML filter sandboxes like Caja rely upon an "older" solution that uses complex parsing techniques, and thousands of regular expressions to filter out XSS payloads. A "newer" solution is the Content-Security Policy, which allows the developer to build HTML pages that are totally immune to reflective and persistent XSS, and this is a stronger protection than what Caja is able to provide. CSP would be the best solution, but it is "too new", IE and older browsers don't support it.

If I needed to jail HTML, I would use Caja with a strict CSP ruleset.


You could also do this:

For every html page that is embedded in a mail, you download the img onto your server for display purposes, rewrite every link to point to your cache, remove javascript that resides on that page. Though this might not be a good idea, load/money/storage/bandwidth wise. This works very well on mails that are sent to you, but have some kind of callback/phone home element.

  • 1
    But to get the image, the webmail server must render the HTML, download images, run javascript, etc, which might defeat the purpose?
    – schroeder
    Commented Mar 1, 2015 at 19:28
  • There's no reason why an html mail requires javascript or any other form of interactivity. This also removes the callback nature of embedded elements.
    – munchkin
    Commented Mar 1, 2015 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .