Mailcatcher executes Javascript in body of the email

[S-DICKSON]

Hi, when email content includes JS it executes the script when selecting the tab Plain Text when viewing email.

Example Email Body
<script>alert("YOu juST beEn hackED ( ͡° ͜ʖ ͡°) ")</script>

Screenshot

[j-dohnalek]

This could be tried a bit different, and perhaps throught the staging environment which is exactly the same as production but different database. This would allow to sent email with JavaScript for testing.

[j-dohnalek]

Maybe not https://www.thoughtco.com/javascript-and-emails-2037682

[sj26]

Yeah the plain text tab doesn't do a good job escaping html tags, since a contributed change a while back to autolink urls in text.

[sj26]

This is tracked in a new issue #446, please follow there.