I'm interested in providing 'HTML email' support for my users (like HotMail, Outlook
Express, Eudora 4.0, etc provide), but I'm very nervous about security. Essentially,
providing HTML email involves letting any arbitrary HTML get displayed by Apache...
Has anyone done this, or can anyone provide any tips on what the minimum amount of
HTML laundering I need to do to avoid security holes? I say 'minimum', because I would
like to maximise the amount of working HTML users can receive.
I assume I don't have to worry about PHP/EmbPerl/etc tags, since by the time mod_perl
is finished with it, it's too late for other handlers to step in (unless I
specifically chain them). Is that right? The only potential holes I can think of are
'javascript:' URLs, which I could just filter out, and cross-site scripting URLs (does
anyone have any code that recognises hrefs with potential cross-site scripting
problems?)
TIA,
Jeremy
