[Caja] Allow full display and interaction with Html Emails

[felbus]

Hi,

tldr; how do I load an html email in to a div with caja, allowing the
loading of images and clickable links

---

Im just starting to use caja, the API links are down, so am not sure
whether this is the default behaviour.

I am loading an html email in to a div like this:

caja.load(document.getElementById('messagebox'), undefined, function(frame) {
frame.code(contentUrl, 'text/html').run();
});


When it is rendered on the page, the images and hrefs are all stripped out.
So you cannot see images or click links.

I am guessing this is the default behaviour to prevent attacks.

My question is how do I allow these to be loaded so that the page is
displayed as intended?

Thanks

['Kevin Reid' via Google Caja Discuss]

Post by felbus
caja.load(document.getElementById('messagebox'), undefined, function(frame) {
frame.code(contentUrl, 'text/html').run();
});
When it is rendered on the page, the images and hrefs are all stripped
out. So you cannot see images or click links.
I am guessing this is the default behaviour to prevent attacks.
My question is how do I allow these to be loaded so that the page is
displayed as intended?

You need to specify the URI policy instead of undefined.

The simplest policy is caja.policy.net.ALL which will allow links and
images for all sites.

[felbus]

yep, that worked, thanks

Post by 'Kevin Reid' via Google Caja Discuss

Post by felbus
caja.load(document.getElementById('messagebox'), undefined, function(frame) {
frame.code(contentUrl, 'text/html').run();
});
When it is rendered on the page, the images and hrefs are all stripped
out. So you cannot see images or click links.
I am guessing this is the default behaviour to prevent attacks.
My question is how do I allow these to be loaded so that the page is
displayed as intended?

You need to specify the URI policy instead of undefined.
The simplest policy is caja.policy.net.ALL which will allow links and
images for all sites.