On 11 Feb 2021, at 10:36, Kris Deugau wrote:
After a close look again at Thunderbird I've apparently been misreading one of the about:config flags (javascript.enabled), although if it's not for email HTML rendering I'm not sure what it's used for.
Thunderbird will open links in its own windows rather than launching a browser, if configured to do so. Like SeaMonkey or Firefox, that internal browser can optionally support JavaScript and by default does so. Once upon a time, there was also a javascript.allow.mailnews flag, but it was removed. The comment at https://bugzilla.mozilla.org/show_bug.cgi?id=13023#c5 implies that JavaScript was "finished off in mail" just over 21 years ago. That is roughly the timeframe for removal of JS in mail support from just about every notable standalone MUA that ever had it, following a couple of rounds of malware using it as a transmission vector.
Web-based MUAs (SquirrelMail, Horde, GMail, Outlook Web Access, etc.) brought back some support for JavaScript in mail, but as I understand some of them do some defanging of scripts and the advancement of browser limitations on nefarious scripts has also helped make those less dangerous than they could be.
-- Bill Cole [email protected] or [email protected] (AKA @grumpybozo and many *@billmail.scconsult.com addresses) Not Currently Available For Hire
