WSS
Web Specification Studio Home
On this page
SecurityRequiredUpdated

Dangerous Content & Prohibited Email Elements

Eliminate prohibited active content (JavaScript, iframes, embedded objects, raw forms) and restrict high-risk file attachment extensions to prevent malware classification.

What it is

Dangerous content policies in email define the strict boundaries of permissible HTML elements, scripting technologies, external media types, and attachment file extensions allowed in outbound email payloads.

Due to extreme security risks (Cross-Site Scripting, malware execution, credential harvesting), email clients implement aggressive sanitizers that strip active scripting and immediately reject or quarantine messages containing dangerous content.

PROHIBITED ACTIVE CONTENT:
❌ <script> (JavaScript / VBScript execution)
❌ <iframe> / <frame> (Arbitrary external frame embedding)
❌ <object> / <embed> / <applet> (Flash, ActiveX, binary plugins)
❌ <form> / <input type="password"> (Phishing / credential harvesting forms)
❌ <svg> with embedded <script> tags or external event handlers

Why it matters

  • Instant Spam Rejection & Domain Penalization: Sending an email containing a <script> or <iframe> tag triggers instant quarantine or deletion by SpamAssassin, Microsoft Defender for Office 365, and Google Workspace gateways.
  • Client Sanitizer Destabilization: Email clients parse and sanitize HTML before rendering. Active content tags trigger aggressive regex sanitizers that often strip surrounding layout tables and CSS styles, destroying the visual layout for legitimate users.
  • Malware Classification via Blocked Attachments: Attaching executable binaries or compressed archives containing script files (.zip containing .js) causes email gateways to drop the entire message without delivering it to the recipient.

How to implement

1. Strictly sanitize user-generated content in email notifications: When embedding user-generated comments, forum replies, or ticket notes into outbound notification emails, run the text through a strict HTML sanitizer (such as DOMPurify with HTML-only profiles or sanitize-html):

import sanitizeHtml from "sanitize-html";

const cleanHtml = sanitizeHtml(userComment, {
  allowedTags: ["b", "i", "em", "strong", "a", "p", "br", "ul", "ol", "li", "span"],
  allowedAttributes: {
    a: ["href", "title", "target", "style"],
    span: ["style"],
    p: ["style"],
  },
  disallowedTagsModes: "discard",
});

2. Never embed HTML <form> elements. While some clients (like Apple Mail) partially support simple form elements, Google, Yahoo, and Outlook disable or strip <form> inputs as a phishing countermeasure. Replace interactive forms with clear, styled CTA buttons that link to authenticated web landing pages:

<!-- INSECURE: Form in email is stripped or blocked -->
<form action="https://example.com/survey" method="POST">
  <input type="text" name="feedback">
  <button type="submit">Submit</button>
</form>

<!-- SECURE: Action button linking to web interface -->
<a href="https://example.com/survey?token=f81d4fae" style="display: inline-block; padding: 12px 24px; background-color: #1d4ed8; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: 600;">
  Take 2-Minute Survey
</a>

3. Restrict Attachment Extensions to Safe Document Formats. Filter attachments against a strict allowlist of benign business document formats (.pdf, .csv, .xlsx, .docx, .png, .jpg). Explicitly block high-risk executable and script formats:

BLOCKED ATTACHMENT EXTENSIONS:
.ade, .adp, .apk, .appx, .bat, .cab, .cmd, .com, .cpl, .diagcab, .diagcfg,
.exe, .gadget, .hta, .img, .ins, .iso, .isp, .jar, .js, .jse, .lib, .lnk,
.mde, .msc, .msi, .msp, .mst, .nsh, .pif, .ps1, .scr, .sct, .shb, .sys,
.vb, .vbe, .vbs, .vhd, .vxd, .wsc, .wsf, .wsh, .xnk

4. Block Password-Protected or Nested Zip Archives: Do not attach encrypted or password-protected ZIP archives. Mailbox providers cannot scan encrypted archives for viruses and automatically quarantine them.

Common mistakes

  • Attempting to Embed Web Video via <video> or <iframe>: Embedding YouTube or Vimeo <iframe> embed codes. Instead, display a video thumbnail image with a static play button overlay that links out to the hosted video page.
  • Using Dynamic SVGs with Inline Scripting: SVGs containing onload= or javascript: handlers. Convert SVGs to static PNG or WebP images before attaching or embedding.
  • Assuming Internal Senders are Safe: Allowing unvalidated HTML generated by internal employee CRM tools to bypass outbound sanitization filters.

Verification

1. Automated HTML Security Linter: Add a pre-send validator step in your email dispatch pipeline that checks for prohibited tags:

const PROHIBITED_TAGS = /<(script|iframe|embed|object|form|input|button|svg|applet)\b/i;
if (PROHIBITED_TAGS.test(renderedHtml)) {
  throw new Error("Security Violation: Prohibited active content detected in email template.");
}

2. Attachment Scanner Test: Verify that attempting to attach a .bat or .js file to an outbound email raises an immediate validation exception at the API layer.

Related topics

Sources & further reading