My assumption was always to trust the mjml content:
- The file might contain might contain untrusted user data, e.g. a name inside a
<mj-text> block.
- However the mjml structure and tags within the content should not be attacker-controlled.
Therefore <mj-include> tags are not a security concern to me - they include whatever the developer wanted to include.
The JS reference implementation seems to take a different approach:
This ticket is a first attempt to convey the security assumptions I made when creating the project. However I'm also open to adding some code which might filter or even block mj-include tags if there is a need (+ willingness to contribute some dev time).
My assumption was always to trust the mjml content:
<mj-text>block.Therefore
<mj-include>tags are not a security concern to me - they include whatever the developer wanted to include.The JS reference implementation seems to take a different approach:
This ticket is a first attempt to convey the security assumptions I made when creating the project. However I'm also open to adding some code which might filter or even block
mj-includetags if there is a need (+ willingness to contribute some dev time).