diff --git a/app/courrier/page.tsx b/app/courrier/page.tsx index 2fbb338d..34358605 100644 --- a/app/courrier/page.tsx +++ b/app/courrier/page.tsx @@ -370,14 +370,28 @@ function getReplyBody(email: Email, type: 'reply' | 'reply-all' | 'forward'): st .join(''); } - // Sanitize HTML content + // Clean HTML content while preserving formatting + content = content + .replace(/]*>[\s\S]*?<\/style>/gi, '') + .replace(/]*>[\s\S]*?<\/script>/gi, '') + .replace(/]*>/gi, '') + .replace(/]*>/gi, '') + .replace(/]*>/gi, '') + .replace(/]*>[\s\S]*?<\/title>/gi, '') + .replace(/]*>[\s\S]*?<\/head>/gi, '') + .replace(/]*>/gi, '') + .replace(/<\/body>/gi, '') + .replace(/]*>/gi, '') + .replace(/<\/html>/gi, ''); + + // Sanitize HTML content while preserving formatting content = DOMPurify.sanitize(content, { ALLOWED_TAGS: [ 'p', 'br', 'div', 'span', 'b', 'i', 'u', 'strong', 'em', 'blockquote', 'ul', 'ol', 'li', 'a', 'h1', 'h2', 'h3', 'h4', - 'table', 'thead', 'tbody', 'tr', 'td', 'th' + 'table', 'thead', 'tbody', 'tr', 'td', 'th', 'pre', 'code' ], - ALLOWED_ATTR: ['href', 'style', 'class'], + ALLOWED_ATTR: ['href', 'style', 'class', 'target'], }); const date = new Date(email.date).toLocaleString(); @@ -386,22 +400,22 @@ function getReplyBody(email: Email, type: 'reply' | 'reply-all' | 'forward'): st return `

-
+

From: ${email.from}

Date: ${date}

Subject: ${email.subject}

To: ${Array.isArray(email.to) ? email.to.join(', ') : email.to}


- ${content} +
${content}
`; } else { return `

-
+

On ${date}, ${email.from} wrote:

- ${content} +
${content}
`; }