Rendering untrusted HTML email, safely(2021)
Summary
A guide from Close on rendering untrusted HTML email safely within a web app. It explains why sanitization was avoided, and how to safely render HTML emails using iframes, the srcdoc attribute, sandbox and CSP, while preventing JavaScript execution and protecting user data. It also covers handling browser support and known limitations.