From 3099b4801e30f1e809b5d5802836060e18595c8a Mon Sep 17 00:00:00 2001 From: Linus Rath <139418639+rathlinus@users.noreply.github.com> Date: Sat, 16 May 2026 20:49:59 +0200 Subject: [PATCH] fix: sandbox thread email HTML in srcDoc iframe with CSP meta --- components/email/email-viewer.tsx | 8 ++ components/email/thread-conversation-view.tsx | 81 ++++++++++++++++--- 2 files changed, 76 insertions(+), 13 deletions(-) diff --git a/components/email/email-viewer.tsx b/components/email/email-viewer.tsx index d0a85156..f225f5f5 100644 --- a/components/email/email-viewer.tsx +++ b/components/email/email-viewer.tsx @@ -2776,8 +2776,16 @@ export function EmailViewer({ p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0 0 6px; } ` : ''; + // Defense-in-depth CSP inside srcDoc: even if the sanitizer ever lets a + //