Scripts in email alter (break) the clients layout about mailspring HOT 5 CLOSED

Hey! Ahh this tool is great—thanks for filing this. I wasn't able to get the test email when I put in Office 365 or Gmail accounts, but I just tested with a yahoo account and actually received the email. I've been able to reproduce here so I'll see how this is happening.

from mailspring.

Hey—just a quick update:

• Digging into this a bit more, the message isn't executing any JavaScript or adding any styles to the client. (phew...) It contains a broken <object> tag though, and somehow rendering the object tag is causing Chromium to re-layout the page with white space at the bottom. (Deleting a DOM node and then undoing the change in the Developer Tools makes it layout again and everything goes back to normal.) I'm definitely going to fix this, but it doesn't appear to be a security issue as much as a rendering bug.

• By default, firing all those tracking pixels is intended behavior. That said, even if you turn off the "automatically load images" option, Mailspring still fires the "object tag data" event back to emailprivacytester.com. With "automatically load images" unchecked, that's the only one that still turns red. Technically I suppose this isn't an image, but I think that checkbox should disable all tracking, not just image based tracking, so I'm gonna fix that as well.

from mailspring.

This should be fixed—I did a bunch of googling and it looks like there's really no legitimate reason for HTML emails to include tags. Just people trying to play video in email or do weird tracking tricks like the one identified here. I've removed <object> from the HTML sanitizer whitelist and confirmed that the layout issue no longer happens and the "Automatically load images" option correctly blocks all tracking now.

from mailspring.

Thank you very much!

but I think that checkbox should disable all tracking, not just image based tracking, so I'm gonna fix that as well.

Very good, you are the first developer of an email client who actually sees this privacy issue. I wrote to some developers of mail clients and they never fixed this and ignored my requests fixing this kind of issue. Sometimes I even had a discussion going resulting in a long email conversation without any success.
Nice to see that the developers of this awesome mail client care and try to block spammers out. The existence and use of an email is checked by spammers with these kind of tricks emailprivacychecker tests against your email client.

Thank you very much for this awesome mail client and the response!

from mailspring.

This broke interactive SVG support. Was this an intended change?

from mailspring.