v0.2.10

src/web/js/00-bootstrap.js

@@ -155,6 +155,21 @@
     return doc.body.innerHTML;
   }
 
+  function sanitizeMessagePreviewHtml(html) {
+    const doc = new DOMParser().parseFromString(sanitizeMessageHtml(html), "text/html");
+    doc.querySelectorAll("a[href]").forEach((node) => {
+      if (!node.hasAttribute("target")) node.setAttribute("target", "_blank");
+      const target = String(node.getAttribute("target") || "").toLowerCase();
+      if (target && !["_self", "_parent", "_top"].includes(target)) {
+        const rel = new Set(String(node.getAttribute("rel") || "").split(/\s+/).filter(Boolean));
+        rel.add("noopener");
+        rel.add("noreferrer");
+        node.setAttribute("rel", [...rel].join(" "));
+      }
+    });
+    return doc.body.innerHTML;
+  }
+
   function sanitizeAttachmentHtml(html) {
     const doc = new DOMParser().parseFromString(sanitizeMessageHtml(html), "text/html");
     doc.querySelectorAll("a[href]").forEach((node) => node.removeAttribute("href"));