Conversation

@galaxis @rysiek Actually, to clarify further: poor HTML parsing and poor error handling is to blame.

Even when rendering HTML, #Mailpile is not vulnerable as far as I can tell.

We sanitize the content so their malformed snippets get cleaned up and we check the GnuPG error codes so their gadgets will fail.

I need to write a boasting blog about this, this is actually a resounding endorsement of why baking security in from the start matters.