#haraka

hi all

anyone have any recommendation for show an email on a webpage? will being mindful of security

i was thinking load the html email into an iframe

and run it through purifier for php

but i am not sure if i should do something else

will haraka work with io.js?

PixelPaul: Hi, about your question about showing emails on a website: you have 2 options for security

1. you can use a subdomain with disallow external scripts, css (https://developer.mozilla.org/en-US/docs/Web/Se...)

2. you pre-process the email and clearing all the stuff that can call from other servers/proxy images/load images to s3

i am thinking of processing it via https://www.npmjs.com/package/dompurify

but i like option 1 too for extra security

just need to figure out how to add those headers for a nodejs response

To your question about iojs: not realy full support, because some deps not iojs compatible, but perhaps with the new version release it will be compatible.

PixelPaul: what you using for a framework? Express?

PixelPaul: dompurify is nice, but don't help against tracker/data collection that use images etc for collection.

the best way is a mix like google mail, they download the external images to there server so the tracking etc. can't be done.

is there any harm in tracking tho??

No but there are Spamer and hackers who hide viruses in external pictures/scripts/css.

scripts and css yes

images?

as most mail clients load images

if the client is buggy it is possible to execute the virus code. It give some realworld examples where it was possible (but in the most case it was very old software)

the virus can infect the user viewing it, but not the webpage that displays it correct?

not the website only the user, thats right

Hello

I understood how to start haraka with child_process but can I pass variable to Haraka (MongoDB connection) ?

And use it with plugins?

hi