Sort of a general "best practices" question

[malonn]

Hi, I am writing an email client in Python (of course) 3. But, I wonder something. I want to remove security vulnerabilities from HTML emails. I know a lot of email clients remove images from the HTML because they connect remotely to web sites and can be used to track if the email address is valid. What other components of HTML should I block for privacy/security reasons? A little digging told me that pretty much any element in an HTML email with a URL value can be insecure. I know links in HTML can look legit, yet actually point to a malicious payload.

So, am I right to think to just block all elements that have a URL as a value? Will this make the email useless? Thunderbird blocks a few things (images, video, other things), Evolution seems to only block images (that I can tell ATM). Would just blocking images and links suffice? I plan on making this project publicly available one day, so security is a concern.

Sorry for posting in this sub-forum. I want eyes on, and I didn't see a more appropriate place.

[stevendaprano]

Your question isn't really a Python question, you are probably better off asking on developer forums for email (say, Thunderbird) and security forums.

Anything which is not physically part of the email message is a potential privacy threat. So any URL is a potential leak, not just images.

You might like to look at how mutt deals with HTML in emails:

• You can instruct mutt to prefer the text, or enhanced text, if one exists.
  • Alas, hardly anyone uses enhanced text, which is a shame as it is capable of dealing with most of the important formatting people demand for their emails, without allowing the risky security and privacy threats.
• You can have mutt extract the plain text from the HTML attachment.
  
• Or have it open in a browser or HTML-viewer.
  

[malonn]

Thanks for the response, @stevendaprano

Yeah, I was thinking it's not ideal to post what amounts to an HTML question in a Python forum. However, you did reinforce my hunch that all URL are a security risk.

I'll check out mutt. Never heard of it.