mirror of
https://github.com/root-fr/jmap-webmail.git
synced 2026-09-24 08:01:19 +00:00
Matthieu MALVACHE
e600cd387d
Emails containing <style> tags were injecting global CSS rules that affected the entire application UI. For example, button:hover rules from emails would override all button hover states app-wide. Changes: - Block <style> tags in email sanitization config (security fix) - Keep inline style attributes for element-specific formatting - Add explicit bg-transparent to banner buttons (defense in depth) - Add CSS isolation to banner container - Fix theme dependency in email content memoization This prevents malicious or poorly-formatted emails from breaking the UI or being used for phishing via CSS injection attacks.