One obvious one that many people fail at initially is sanitizing any HTML-formatted mail.
You don't want viewing the mail to result in an XSS attack against the mail-viewing application, stealing your login cookie for example.
back
1 comments
Both GMail and FastMail have had this vulnerability in the past. GMail had it when script was hidden inside SVGs. FastMail had it when script was embedded in attachment filenames. I'm sure lots of other webmail systems had/have these issues too.