Good news! I have a rudimentary version working. It strips all tags and attributes, which are not explicitly allowed, from the document. That way, you can have the advantages of HTML (expressive and mostly unambiguous syntax, in contrast to plaintext) without most of the disadvantages (large security and privacy problems). In fact, I think that this feature is what makes HTML mail a useable (and possibly preferable) option. THe code might also be used to an ultra-secure (and uncomfortable) browser, but I don't have this implemented yet. My current implementation is, however, relatively dumb about what can be allowed and disallowed - you can only (dis)allow certain tags and attributes, but not where they may appear. (This makes the implementation much more simple.) E.g. it is impossible to disallow a certain element being a child of another element or to disallow multiple <head> nodes. Currently, you can't even disallow text directly inside an element, e.g. the <head> node (I might fix that case, however). Disallowed tags and attributes will just not be output to the result. This is in line with the HTML convention of just ignoring unknown tags. (You should be able to remove the <applet>/</applet> tags an still get a reasonable document.) I also hooked this up with Mailnews' libmime. I added it as new option to the View|Body menu introduced in bug 30888. The current implementation takes a (Mozilla Gecko-)parsed HTML document and outputs HTML source to a string. This means that we have to parse the result again. I am aware of the performance implications and I wrote a longer explanation in the source as comments. This blocks bug 54182, because I want to make this the default in Beonex Communicator. I don't request review yet, because I want to clean up the source more and refactor it more. Maybe, I'll be done later this day.
Bug 108153 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Good news! I have a rudimentary version working. It strips all tags and attributes, which are not explicitly allowed, from the document. That way, you can have the advantages of HTML (expressive and mostly unambiguous syntax, in contrast to plaintext) without most of the disadvantages (large security and privacy problems). In fact, I think that this feature is what makes HTML mail a useable (and possibly preferable) option. THe code might also be used to an ultra-secure (and uncomfortable) browser, but I don't have this implemented yet. My current implementation is, however, relatively dumb about what can be allowed and disallowed - you can only (dis)allow certain tags and attributes, but not where they may appear. (This makes the implementation much more simple.) E.g. it is impossible to disallow a certain element being a child of another element or to disallow multiple <head> nodes. Currently, you can't even disallow text directly inside an element, e.g. the <head> node (I might fix that case, however). Disallowed tags and attributes will just not be output to the result. This is in line with the HTML convention of just ignoring unknown tags. (You should be able to remove the <applet>/</applet> tags an still get a reasonable document.) I also hooked this up with Mailnews' libmime. I added it as new option to the View|Body menu introduced in bug 30888. The current implementation takes a (Mozilla Gecko-)parsed HTML document and outputs HTML source to a string. This means that we have to parse the result again. I am aware of the performance implications and I wrote a longer explanation in the source as comments. This blocks bug 54184, because I want to make this the default in Beonex Communicator. I don't request review yet, because I want to clean up the source more and refactor it more. Maybe, I'll be done later this day.