Rendering untrusted HTML email, safely(2021) making.close.com

Close’s Phil Freo explains how the company renders synced HTML emails in its web app without running their JavaScript: it places the email in a sandboxed `srcdoc` iframe and layers on a Content Security Policy that blocks scripts. The 2021 post also covers browser support checks and tradeoffs, including handling images and iframe sizing.