1// Package webmail implements a webmail client, serving html/js and providing an API for message actions and SSE endpoint for receiving real-time updates.
4// todo: should we be serving the messages/parts on a separate (sub)domain for user-content? to limit damage if the csp rules aren't enough.
27 "golang.org/x/net/html"
29 "github.com/prometheus/client_golang/prometheus"
30 "github.com/prometheus/client_golang/prometheus/promauto"
32 "github.com/mjl-/bstore"
33 "github.com/mjl-/sherpa"
35 "github.com/mjl-/mox/message"
36 "github.com/mjl-/mox/metrics"
37 "github.com/mjl-/mox/mlog"
38 "github.com/mjl-/mox/mox-"
39 "github.com/mjl-/mox/moxio"
40 "github.com/mjl-/mox/store"
41 "github.com/mjl-/mox/webauth"
42 "github.com/mjl-/mox/webops"
45var pkglog = mlog.New("webmail", nil)
49// We pass the request to the sherpa handler so the TLS info can be used for
50// the Received header in submitted messages. Most API calls need just the
52var requestInfoCtxKey ctxKey = "requestInfo"
54type requestInfo struct {
57 Account *store.Account // Nil only for methods Login and LoginPrep.
58 SessionToken store.SessionToken
59 Response http.ResponseWriter
60 Request *http.Request // For Proto and TLS connection state during message submit.
63//go:embed webmail.html
70var webmailmsgHTML []byte
73var webmailmsgJS []byte
76var webmailtextHTML []byte
79var webmailtextJS []byte
82 // Similar between ../webmail/webmail.go:/metricSubmission and ../smtpserver/server.go:/metricSubmission and ../webapisrv/server.go:/metricSubmission
83 metricSubmission = promauto.NewCounterVec(
84 prometheus.CounterOpts{
85 Name: "mox_webmail_submission_total",
86 Help: "Webmail message submission results, known values (those ending with error are server errors): ok, badfrom, messagelimiterror, recipientlimiterror, queueerror, storesenterror.",
92 metricServerErrors = promauto.NewCounterVec(
93 prometheus.CounterOpts{
94 Name: "mox_webmail_errors_total",
95 Help: "Webmail server errors, known values: dkimsign, submit.",
101 metricSSEConnections = promauto.NewGauge(
102 prometheus.GaugeOpts{
103 Name: "mox_webmail_sse_connections",
104 Help: "Number of active webmail SSE connections.",
109func xcheckf(ctx context.Context, err error, format string, args ...any) {
113 msg := fmt.Sprintf(format, args...)
114 errmsg := fmt.Sprintf("%s: %s", msg, err)
115 pkglog.WithContext(ctx).Errorx(msg, err)
116 code := "server:error"
117 if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
120 panic(&sherpa.Error{Code: code, Message: errmsg})
123func xcheckuserf(ctx context.Context, err error, format string, args ...any) {
127 msg := fmt.Sprintf(format, args...)
128 errmsg := fmt.Sprintf("%s: %s", msg, err)
129 pkglog.WithContext(ctx).Errorx(msg, err)
130 panic(&sherpa.Error{Code: "user:error", Message: errmsg})
133func xdbwrite(ctx context.Context, acc *store.Account, fn func(tx *bstore.Tx)) {
134 err := acc.DB.Write(ctx, func(tx *bstore.Tx) error {
138 xcheckf(ctx, err, "transaction")
141func xdbread(ctx context.Context, acc *store.Account, fn func(tx *bstore.Tx)) {
142 err := acc.DB.Read(ctx, func(tx *bstore.Tx) error {
146 xcheckf(ctx, err, "transaction")
149var webmailFile = &mox.WebappFile{
152 HTMLPath: filepath.FromSlash("webmail/webmail.html"),
153 JSPath: filepath.FromSlash("webmail/webmail.js"),
156// Serve content, either from a file, or return the fallback data. Caller
157// should already have set the content-type. We use this to return a file from
158// the local file system (during development), or embedded in the binary (when
160func serveContentFallback(log mlog.Log, w http.ResponseWriter, r *http.Request, path string, fallback []byte) {
161 f, err := os.Open(path)
166 http.ServeContent(w, r, "", st.ModTime(), f)
170 http.ServeContent(w, r, "", mox.FallbackMtime(log), bytes.NewReader(fallback))
174 mox.NewWebmailHandler = func(maxMsgSize int64, basePath string, isForwarded bool, accountPath string) http.Handler {
175 return http.HandlerFunc(Handler(maxMsgSize, basePath, isForwarded, accountPath))
179// Handler returns a handler for the webmail endpoints, customized for the max
180// message size coming from the listener and cookiePath.
181func Handler(maxMessageSize int64, cookiePath string, isForwarded bool, accountPath string) func(w http.ResponseWriter, r *http.Request) {
182 sh, err := makeSherpaHandler(maxMessageSize, cookiePath, isForwarded)
183 return func(w http.ResponseWriter, r *http.Request) {
185 http.Error(w, "500 - internal server error - cannot handle requests", http.StatusInternalServerError)
188 handle(sh, isForwarded, accountPath, w, r)
192func handle(apiHandler http.Handler, isForwarded bool, accountPath string, w http.ResponseWriter, r *http.Request) {
194 log := pkglog.WithContext(ctx).With(slog.String("userauth", ""))
196 // Server-sent event connection, for all initial data (list of mailboxes), list of
197 // messages, and all events afterwards. Authenticated through a single use token in
198 // the query string, which it got from a Token API call.
199 if r.URL.Path == "/events" {
200 serveEvents(ctx, log, accountPath, w, r)
209 err, ok := x.(*sherpa.Error)
211 log.WithContext(ctx).Error("handle panic", slog.Any("err", x))
213 metrics.PanicInc(metrics.Webmailhandle)
216 if strings.HasPrefix(err.Code, "user:") {
217 log.Debugx("webmail user error", err)
218 http.Error(w, "400 - bad request - "+err.Message, http.StatusBadRequest)
220 log.Errorx("webmail server error", err)
221 http.Error(w, "500 - internal server error - "+err.Message, http.StatusInternalServerError)
230 h.Set("X-Frame-Options", "deny")
231 h.Set("Referrer-Policy", "same-origin")
232 webmailFile.Serve(ctx, log, w, r)
234 http.Error(w, "405 - method not allowed - use get", http.StatusMethodNotAllowed)
238 case "/msg.js", "/text.js":
241 http.Error(w, "405 - method not allowed - use get", http.StatusMethodNotAllowed)
246 path := filepath.Join("webmail", r.URL.Path[1:])
247 var fallback = webmailmsgJS
248 if r.URL.Path == "/text.js" {
249 fallback = webmailtextJS
252 w.Header().Set("Content-Type", "application/javascript; charset=utf-8")
253 serveContentFallback(log, w, r, path, fallback)
257 isAPI := strings.HasPrefix(r.URL.Path, "/api/")
258 // Only allow POST for calls, they will not work cross-domain without CORS.
259 if isAPI && r.URL.Path != "/api/" && r.Method != "POST" {
260 http.Error(w, "405 - method not allowed - use post", http.StatusMethodNotAllowed)
264 var loginAddress, accName string
265 var sessionToken store.SessionToken
266 // All other URLs, except the login endpoint require some authentication.
267 if r.URL.Path != "/api/LoginPrep" && r.URL.Path != "/api/Login" {
269 isExport := r.URL.Path == "/export"
270 requireCSRF := isAPI || isExport
271 accName, sessionToken, loginAddress, ok = webauth.Check(ctx, log, webauth.Accounts, "webmail", isForwarded, w, r, isAPI, requireCSRF, isExport)
273 // Response has been written already.
279 var acc *store.Account
281 log = log.With(slog.String("account", accName))
283 acc, err = store.OpenAccount(log, accName)
285 log.Errorx("open account", err)
286 http.Error(w, "500 - internal server error - error opening account", http.StatusInternalServerError)
291 log.Check(err, "closing account")
294 reqInfo := requestInfo{log, loginAddress, acc, sessionToken, w, r}
295 ctx = context.WithValue(ctx, requestInfoCtxKey, reqInfo)
296 apiHandler.ServeHTTP(w, r.WithContext(ctx))
300 // We are now expecting the following URLs:
302 // .../msg/<msgid>/{attachments.zip,parsedmessage.js,raw}
303 // .../msg/<msgid>/{,msg}{text,html,htmlexternal}
304 // .../msg/<msgid>/{view,viewtext,download}/<partid>
306 if r.URL.Path == "/export" {
307 webops.Export(log, accName, w, r)
311 if !strings.HasPrefix(r.URL.Path, "/msg/") {
316 t := strings.Split(r.URL.Path[len("/msg/"):], "/")
322 id, err := strconv.ParseInt(t[0], 10, 64)
323 if err != nil || id == 0 {
328 // Many of the requests need either a message or a parsed part. Make it easy to
329 // fetch/prepare and cleanup. We only do all the work when the request seems legit
330 // (valid HTTP route and method).
331 xprepare := func() (acc *store.Account, m store.Message, msgr *store.MsgReader, p message.Part, cleanup func(), ok bool) {
332 if r.Method != "GET" {
333 http.Error(w, "405 - method not allowed - post required", http.StatusMethodNotAllowed)
343 log.Check(err, "closing message reader")
348 log.Check(err, "closing account")
355 acc, err = store.OpenAccount(log, accName)
356 xcheckf(ctx, err, "open account")
358 m = store.Message{ID: id}
359 err = acc.DB.Get(ctx, &m)
360 if err == bstore.ErrAbsent || err == nil && m.Expunged {
364 xcheckf(ctx, err, "get message")
366 msgr = acc.MessageReader(m)
368 p, err = m.LoadPart(msgr)
369 xcheckf(ctx, err, "load parsed message")
373 log.Check(err, "closing message reader")
375 log.Check(err, "closing account")
383 // We set a Content-Security-Policy header that is as strict as possible, depending
384 // on the type of message/part/html/js. We have to be careful because we are
385 // returning data that is coming in from external places. E.g. HTML could contain
386 // javascripts that we don't want to execute, especially not on our domain. We load
387 // resources in an iframe. The CSP policy starts out with default-src 'none' to
388 // disallow loading anything, then start allowing what is safe, such as inlined
389 // datauri images and inline styles. Data can only be loaded when the request is
390 // coming from the same origin (so other sites cannot include resources
391 // (messages/parts)).
393 // We want to load resources in sandbox-mode, causing the page to be loaded as from
394 // a different origin. If sameOrigin is set, we have a looser CSP policy:
395 // allow-same-origin is set so resources are loaded as coming from this same
396 // origin. This is needed for the msg* endpoints that render a message, where we
397 // load the message body in a separate iframe again (with stricter CSP again),
398 // which we need to access for its inner height. If allowSelfScript is also set
399 // (for "msgtext"), the CSP leaves out the sandbox entirely.
401 // If allowExternal is set, we allow loading image, media (audio/video), styles and
402 // fronts from external URLs as well as inline URI's. By default we don't allow any
403 // loading of content, except inlined images (we do that ourselves for images
404 // embedded in the email), and we allow inline styles (which are safely constrained
407 // If allowSelfScript is set, inline scripts and scripts from our origin are
408 // allowed. Used to display a message including header. The header is rendered with
409 // javascript, the content is rendered in a separate iframe with a CSP that doesn't
410 // have allowSelfScript.
411 headers := func(sameOrigin, allowExternal, allowSelfScript, allowSelfImg bool) {
412 // allow-popups is needed to make opening links in new tabs work.
413 sb := "sandbox allow-popups allow-popups-to-escape-sandbox; "
414 if sameOrigin && allowSelfScript {
415 // Sandbox with both allow-same-origin and allow-script would not provide security,
416 // and would give warning in console about that.
418 } else if sameOrigin {
419 sb = "sandbox allow-popups allow-popups-to-escape-sandbox allow-same-origin; "
423 script = "; script-src 'unsafe-inline' 'self'; frame-src 'self'; connect-src 'self'"
427 csp = sb + "frame-ancestors 'self'; default-src 'none'; img-src data: http: https: 'unsafe-inline'; style-src 'unsafe-inline' data: http: https:; font-src data: http: https: 'unsafe-inline'; media-src 'unsafe-inline' data: http: https:" + script
428 } else if allowSelfImg {
429 csp = sb + "frame-ancestors 'self'; default-src 'none'; img-src data: 'self'; style-src 'unsafe-inline'" + script
431 csp = sb + "frame-ancestors 'self'; default-src 'none'; img-src data:; style-src 'unsafe-inline'" + script
433 h.Set("Content-Security-Policy", csp)
434 h.Set("X-Frame-Options", "sameorigin") // Duplicate with CSP, but better too much than too little.
435 h.Set("X-Content-Type-Options", "nosniff")
436 h.Set("Referrer-Policy", "no-referrer")
440 case len(t) == 2 && t[1] == "attachments.zip":
441 acc, m, msgr, p, cleanup, ok := xprepare()
446 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}
447 // note: state is cleared by cleanup
449 mi, err := messageItem(log, m, &state)
450 xcheckf(ctx, err, "parsing message")
452 headers(false, false, false, false)
453 h.Set("Content-Type", "application/zip")
454 h.Set("Cache-Control", "no-store, max-age=0")
455 var subjectSlug string
456 if p.Envelope != nil {
457 s := p.Envelope.Subject
458 s = strings.ToLower(s)
459 s = regexp.MustCompile("[^a-z0-9_.-]").ReplaceAllString(s, "-")
460 s = regexp.MustCompile("--*").ReplaceAllString(s, "-")
461 s = strings.TrimLeft(s, "-")
462 s = strings.TrimRight(s, "-")
468 filename := fmt.Sprintf("email-%d-attachments-%s%s.zip", m.ID, m.Received.Format("20060102-150405"), subjectSlug)
469 cd := mime.FormatMediaType("attachment", map[string]string{"filename": filename})
470 h.Set("Content-Disposition", cd)
472 zw := zip.NewWriter(w)
473 names := map[string]bool{}
474 for _, a := range mi.Attachments {
476 name := tryDecodeParam(log, ap.ContentTypeParams["name"])
478 // We don't check errors, this is all best-effort.
480 disposition := h.Get("Content-Disposition")
481 _, params, _ := mime.ParseMediaType(disposition)
482 name = tryDecodeParam(log, params["filename"])
485 name = filepath.Base(name)
487 mt := strings.ToLower(ap.MediaType + "/" + ap.MediaSubType)
488 if name == "" || names[name] {
489 ext := filepath.Ext(name)
491 // Handle just a few basic types.
492 extensions := map[string]string{
493 "text/plain": ".txt",
494 "text/html": ".html",
495 "image/jpeg": ".jpg",
498 "application/zip": ".zip",
506 if name != "" && strings.HasSuffix(name, ext) {
507 stem = strings.TrimSuffix(name, ext)
510 for _, index := range a.Path {
511 stem += fmt.Sprintf("-%d", index)
518 name = stem + fmt.Sprintf("-%d", seq) + ext
523 fh := zip.FileHeader{
525 Modified: m.Received,
527 nodeflate := map[string]bool{
528 "application/x-bzip2": true,
529 "application/zip": true,
530 "application/x-zip-compressed": true,
531 "application/gzip": true,
532 "application/x-gzip": true,
533 "application/vnd.rar": true,
534 "application/x-rar-compressed": true,
535 "application/x-7z-compressed": true,
537 // Sniff content-type as well for compressed data.
538 buf := make([]byte, 512)
539 n, _ := io.ReadFull(ap.Reader(), buf)
542 sniffmt = strings.ToLower(http.DetectContentType(buf[:n]))
544 deflate := ap.MediaType != "VIDEO" && ap.MediaType != "AUDIO" && (ap.MediaType != "IMAGE" || ap.MediaSubType == "BMP") && !nodeflate[mt] && !nodeflate[sniffmt]
546 fh.Method = zip.Deflate
548 // We cannot return errors anymore: we have already sent an application/zip header.
549 if zf, err := zw.CreateHeader(&fh); err != nil {
550 log.Check(err, "adding to zip file")
552 } else if _, err := io.Copy(zf, ap.Reader()); err != nil {
553 log.Check(err, "writing to zip file")
558 log.Check(err, "final write to zip file")
560 // Raw display of a message, as text/plain.
561 case len(t) == 2 && t[1] == "raw":
562 _, _, msgr, p, cleanup, ok := xprepare()
568 // We intentially use text/plain. We certainly don't want to return a format that
569 // browsers or users would think of executing. We do set the charset if available
570 // on the outer part. If present, we assume it may be relevant for other parts. If
571 // not, there is not much we could do better...
572 headers(false, false, false, false)
574 params := map[string]string{}
575 if charset := p.ContentTypeParams["charset"]; charset != "" {
576 params["charset"] = charset
578 h.Set("Content-Type", mime.FormatMediaType(ct, params))
579 h.Set("Cache-Control", "no-store, max-age=0")
581 _, err := io.Copy(w, &moxio.AtReader{R: msgr})
582 log.Check(err, "writing raw")
584 case len(t) == 2 && (t[1] == "msgtext" || t[1] == "msghtml" || t[1] == "msghtmlexternal"):
585 // msg.html has a javascript tag with message data, and javascript to render the
586 // message header like the regular webmail.html and to load the message body in a
587 // separate iframe with a separate request with stronger CSP.
588 acc, m, msgr, p, cleanup, ok := xprepare()
594 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}
595 // note: state is cleared by cleanup
597 pm, err := parsedMessage(log, m, &state, true, true)
598 xcheckf(ctx, err, "getting parsed message")
599 if t[1] == "msgtext" && len(pm.Texts) == 0 || t[1] != "msgtext" && !pm.HasHTML {
600 http.Error(w, "400 - bad request - no such part", http.StatusBadRequest)
605 loadExternal := t[1] == "msghtmlexternal"
606 allowSelfScript := true
607 headers(sameorigin, loadExternal, allowSelfScript, false)
608 h.Set("Content-Type", "text/html; charset=utf-8")
609 h.Set("Cache-Control", "no-store, max-age=0")
611 path := filepath.FromSlash("webmail/msg.html")
612 fallback := webmailmsgHTML
613 serveContentFallback(log, w, r, path, fallback)
615 case len(t) == 2 && t[1] == "parsedmessage.js":
616 // Used by msg.html, for the msg* endpoints, for the data needed to show all data
617 // except the message body.
618 // This is js with data inside instead so we can load it synchronously, which we do
619 // to get a "loaded" event after the page was actually loaded.
621 acc, m, msgr, p, cleanup, ok := xprepare()
626 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}
627 // note: state is cleared by cleanup
629 pm, err := parsedMessage(log, m, &state, true, true)
630 xcheckf(ctx, err, "parsing parsedmessage")
631 pmjson, err := json.Marshal(pm)
632 xcheckf(ctx, err, "marshal parsedmessage")
636 mi := MessageItem{m, pm.envelope, pm.attachments, pm.isSigned, pm.isEncrypted, pm.firstLine, false}
637 mijson, err := json.Marshal(mi)
638 xcheckf(ctx, err, "marshal messageitem")
640 headers(false, false, false, false)
641 h.Set("Content-Type", "application/javascript; charset=utf-8")
642 h.Set("Cache-Control", "no-store, max-age=0")
644 _, err = fmt.Fprintf(w, "window.messageItem = %s;\nwindow.parsedMessage = %s;\n", mijson, pmjson)
645 log.Check(err, "writing parsedmessage.js")
647 case len(t) == 2 && t[1] == "text":
648 // Returns text.html whichs loads the message data with a javascript tag and
649 // renders just the text content with the same code as webmail.html. Used by the
650 // iframe in the msgtext endpoint. Not used by the regular webmail viewer, it
651 // renders the text itself, with the same shared js code.
652 acc, m, msgr, p, cleanup, ok := xprepare()
658 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}
659 // note: state is cleared by cleanup
661 pm, err := parsedMessage(log, m, &state, true, true)
662 xcheckf(ctx, err, "parsing parsedmessage")
664 if len(pm.Texts) == 0 {
665 http.Error(w, "400 - bad request - no text part in message", http.StatusBadRequest)
669 // Needed for inner document height for outer iframe height in separate message view.
671 allowSelfScript := true
673 headers(sameorigin, false, allowSelfScript, allowSelfImg)
674 h.Set("Content-Type", "text/html; charset=utf-8")
675 h.Set("Cache-Control", "no-store, max-age=0")
677 // We typically return the embedded file, but during development it's handy to load
679 path := filepath.FromSlash("webmail/text.html")
680 fallback := webmailtextHTML
681 serveContentFallback(log, w, r, path, fallback)
683 case len(t) == 2 && (t[1] == "html" || t[1] == "htmlexternal"):
684 // Returns the first HTML part, with "cid:" URIs replaced with an inlined datauri
685 // if the referenced Content-ID attachment can be found.
686 _, _, _, p, cleanup, ok := xprepare()
692 setHeaders := func() {
693 // Needed for inner document height for outer iframe height in separate message
694 // view. We only need that when displaying as a separate message on the msghtml*
695 // endpoints. When displaying in the regular webmail, we don't need to know the
696 // inner height so we load it as different origin, which should be safer.
697 sameorigin := r.URL.Query().Get("sameorigin") == "true"
698 allowExternal := strings.HasSuffix(t[1], "external")
699 headers(sameorigin, allowExternal, false, false)
701 h.Set("Content-Type", "text/html; charset=utf-8")
702 h.Set("Cache-Control", "no-store, max-age=0")
705 // todo: skip certain html parts? e.g. with content-disposition: attachment?
707 var usePart func(p *message.Part, parents []*message.Part)
708 usePart = func(p *message.Part, parents []*message.Part) {
712 mt := p.MediaType + "/" + p.MediaSubType
716 err := inlineSanitizeHTML(log, setHeaders, w, p, parents)
718 http.Error(w, "400 - bad request - "+err.Error(), http.StatusBadRequest)
722 parents = append(parents, p)
723 for _, sp := range p.Parts {
724 usePart(&sp, parents)
730 http.Error(w, "400 - bad request - no html part in message", http.StatusBadRequest)
733 case len(t) == 3 && (t[1] == "view" || t[1] == "viewtext" || t[1] == "download"):
734 // View any part, as referenced in the last element path. "0" is the whole message,
735 // 0.0 is the first subpart, etc. "view" returns it with the content-type from the
736 // message (could be dangerous, but we set strict CSP headers), "viewtext" returns
737 // data with a text/plain content-type so the browser will attempt to display it,
738 // and "download" adds a content-disposition header causing the browser the
739 // download the file.
740 _, _, _, p, cleanup, ok := xprepare()
746 paths := strings.Split(t[2], ".")
747 if len(paths) == 0 || paths[0] != "0" {
752 for _, e := range paths[1:] {
753 index, err := strconv.ParseInt(e, 10, 32)
754 if err != nil || index < 0 || int(index) >= len(ap.Parts) {
758 ap = ap.Parts[int(index)]
761 headers(false, false, false, false)
763 if t[1] == "viewtext" {
766 ct = strings.ToLower(ap.MediaType + "/" + ap.MediaSubType)
768 h.Set("Content-Type", ct)
769 h.Set("Cache-Control", "no-store, max-age=0")
770 if t[1] == "download" {
771 name := tryDecodeParam(log, ap.ContentTypeParams["name"])
773 // We don't check errors, this is all best-effort.
775 disposition := h.Get("Content-Disposition")
776 _, params, _ := mime.ParseMediaType(disposition)
777 name = tryDecodeParam(log, params["filename"])
780 name = "attachment.bin"
782 cd := mime.FormatMediaType("attachment", map[string]string{"filename": name})
783 h.Set("Content-Disposition", cd)
786 _, err := io.Copy(w, ap.Reader())
787 if err != nil && !moxio.IsClosed(err) {
788 log.Errorx("copying attachment", err)
795// inlineSanitizeHTML writes the part as HTML, with "cid:" URIs for html "src"
796// attributes inlined and with potentially dangerous tags removed (javascript). The
797// sanitizing is just a first layer of defense, CSP headers block execution of
798// scripts. If the HTML becomes too large, an error is returned. Before writing
799// HTML, setHeaders is called to write the required headers for content-type and
800// CSP. On error, setHeader is not called, no output is written and the caller
801// should write an error response.
802func inlineSanitizeHTML(log mlog.Log, setHeaders func(), w io.Writer, p *message.Part, parents []*message.Part) error {
803 // Prepare cids if there is a chance we will use them.
804 cids := map[string]*message.Part{}
805 for _, parent := range parents {
806 if parent.MediaType+"/"+parent.MediaSubType == "MULTIPART/RELATED" && p.DecodedSize < 2*1024*1024 {
807 for i, rp := range parent.Parts {
808 if rp.ContentID != "" {
809 cids[strings.ToLower(rp.ContentID)] = &parent.Parts[i]
815 node, err := html.Parse(p.ReaderUTF8OrBinary())
817 return fmt.Errorf("parsing html: %v", err)
820 // We track size, if it becomes too much, we abort and still copy as regular html.
822 if err := inlineNode(node, cids, &totalSize); err != nil {
823 return fmt.Errorf("inline cid uris in html nodes: %w", err)
827 err = html.Render(w, node)
828 log.Check(err, "writing html")
832// We inline cid: URIs into data: URIs. If a cid is missing in the
833// multipart/related, we ignore the error and continue with other HTML nodes. It
834// will probably just result in a "broken image". We limit the max size we
835// generate. We only replace "src" attributes that start with "cid:". A cid URI
836// could theoretically occur in many more places, like link href, and css url().
837// That's probably not common though. Let's wait for someone to need it.
838func inlineNode(node *html.Node, cids map[string]*message.Part, totalSize *int64) error {
839 for i, a := range node.Attr {
840 if a.Key != "src" || !caselessPrefix(a.Val, "cid:") || a.Namespace != "" {
844 ap := cids["<"+strings.ToLower(cid)+">"]
846 // Missing cid, can happen with email, no need to stop returning data.
849 *totalSize += ap.DecodedSize
850 if *totalSize >= 10*1024*1024 {
851 return fmt.Errorf("html too large")
853 var sb strings.Builder
854 if _, err := fmt.Fprintf(&sb, "data:%s;base64,", strings.ToLower(ap.MediaType+"/"+ap.MediaSubType)); err != nil {
855 return fmt.Errorf("writing datauri: %v", err)
857 w := base64.NewEncoder(base64.StdEncoding, &sb)
858 if _, err := io.Copy(w, ap.Reader()); err != nil {
859 return fmt.Errorf("writing base64 datauri: %v", err)
861 node.Attr[i].Val = sb.String()
863 for node = node.FirstChild; node != nil; node = node.NextSibling {
864 if err := inlineNode(node, cids, totalSize); err != nil {
871func caselessPrefix(k, pre string) bool {
872 return len(k) >= len(pre) && strings.EqualFold(k[:len(pre)], pre)
875var targetable = map[string]bool{
882// sanitizeNode removes script elements, on* attributes, javascript: href
883// attributes, adds target="_blank" to all links and to a base tag.
884func sanitizeNode(node *html.Node) {
886 var haveTarget, haveRel bool
887 for i < len(node.Attr) {
889 // Remove dangerous attributes.
890 if strings.HasPrefix(a.Key, "on") || a.Key == "href" && caselessPrefix(a.Val, "javascript:") || a.Key == "src" && caselessPrefix(a.Val, "data:text/html") {
891 copy(node.Attr[i:], node.Attr[i+1:])
892 node.Attr = node.Attr[:len(node.Attr)-1]
895 if a.Key == "target" {
896 node.Attr[i].Val = "_blank"
899 if a.Key == "rel" && targetable[node.Data] {
900 node.Attr[i].Val = "noopener noreferrer"
905 // Ensure target attribute is set for elements that can have it.
906 if !haveTarget && node.Type == html.ElementNode && targetable[node.Data] {
907 node.Attr = append(node.Attr, html.Attribute{Key: "target", Val: "_blank"})
910 if haveTarget && !haveRel {
911 node.Attr = append(node.Attr, html.Attribute{Key: "rel", Val: "noopener noreferrer"})
915 node = node.FirstChild
918 // Set next now, we may remove cur, which clears its NextSibling.
920 node = node.NextSibling
922 // Remove script elements.
923 if cur.Type == html.ElementNode && cur.Data == "script" {
924 parent.RemoveChild(cur)
929 if parent.Type == html.ElementNode && parent.Data == "head" && !haveBase {
930 n := html.Node{Type: html.ElementNode, Data: "base", Attr: []html.Attribute{{Key: "target", Val: "_blank"}, {Key: "rel", Val: "noopener noreferrer"}}}
931 parent.AppendChild(&n)