Javascript execution in email body

Question

I've tried sending html/JS code as an email body. Ideally, any naive web client/browser would read it along with the other HTML/JS in the page and execute it.

But I believe yahoomail, gmail and other popular mail clients take care of this possibility.

Experience: I had experimented sending an alert box from within the email body. But I am just able to see the text.

As a developer, I was wondering what elements help the client to identify these HTML/JS code different from the other normal ones in the page. I believe there has to be some security element associated with it. Are there some articles around which explain these effects in detail?

Answer 1

This is a security risk to be able to send arbitrary js to another user. It is called cross site scripting. You can read more about it here https://security.stackexchange.com/questions/12568/is-e-mail-a-direct-vector-for-xss. So to answer your question unless the reader of your email enables js execution (which would be bad) your js is gonna just be sent as plain text.