nicholaschiang/hammock

Open newsletter links in new tab (instead of iframe)

nicholaschiang opened this issue · 3 comments

nicholaschiang commented

Similar to what Gmail already does, we should modify all the links within an HTML email to open in a new tab. We should also take care of any security concerns like tabnabbing by using rel attributes:

<link href="https://external-link.com" rel="noopener noreferrer" target="_blank" />

See this original Notion issue from @jurajpal or @martinsrna (I'm not sure).

nicholaschiang commented

Some StackOverflow answers on how to safely parse and display HTML emails:

Ideally, we'd want to just do what Gmail does: embed a safe "bleached" version of the HTML email directly into the DOM. To do this, we need a secure way to sanitize the email HTML and ensure that it is safe to embed directly. There are a couple of popular libraries for this (because we definitely should not build this ourselves):

Once we sanitize the HTML emails, we will probably want to take that a step further and, instead of embedding them directly into the DOM, we should place them within a sandboxed iframe and implement a strict CSP to prevent XSS attacks.

nicholaschiang commented

This issue itself would be easily solved using a DOMPurify hook:

DOMPurify.addHook('afterSanitizeAttributes', function(node) {
    // open all links in a new window
    if ('target' in node) {
        node.setAttribute('target', '_blank');
    }
});