fix(emailPreview): open in-body links in a new tab via injected <base>

rubenhensen · rubenhensen · commit b7819d0d8c80 · 2026-06-03T12:01:12.000+02:00
Clicking the "Download your files" link (or the link-text link) inside
the preview iframe tried to navigate the iframe itself. The sandbox
deliberately omits `allow-top-navigation`, so the navigation was
blocked and the iframe blanked out — leaving the modal open with an
empty body.

Splice `&lt;base target="_blank" rel="noopener"&gt;` into the rendered
email's `&lt;head&gt;` (or prepend it if the template ever stops having
one) before handing the HTML to `srcdoc`. Anchors then open in a new
top-level tab, which the existing `allow-popups` /
`allow-popups-to-escape-sandbox` flags already permit. No cryptify
change needed — the real email never needed `target="_blank"`, only
the preview surface does.
diff --git a/src/lib/components/filesharing/EmailPreviewModal.svelte b/src/lib/components/filesharing/EmailPreviewModal.svelte
@@ -83,6 +83,24 @@
     function handleKey(e: KeyboardEvent) {
         if (e.key === 'Escape') onClose()
     }
+
+    /** Inject `<base target="_blank">` into the rendered email HTML so
+     *  anchor clicks open in a new top-level tab instead of trying to
+     *  navigate the sandboxed iframe (which has no `allow-top-navigation`
+     *  and would otherwise blank the body). The `allow-popups` /
+     *  `allow-popups-to-escape-sandbox` flags already permit the new
+     *  tab. We try to splice into an existing `<head>`; if cryptify ever
+     *  changes the template shape, the prepended fallback still works
+     *  because browsers tolerate a `<base>` before `<html>`. */
+    function withBaseTarget(html: string): string {
+        const tag = '<base target="_blank" rel="noopener">'
+        const headIdx = html.search(/<head[^>]*>/i)
+        if (headIdx >= 0) {
+            const end = html.indexOf('>', headIdx) + 1
+            return html.slice(0, end) + tag + html.slice(end)
+        }
+        return tag + html
+    }
 </script>
 
 <svelte:window onkeydown={handleKey} />
@@ -185,7 +203,7 @@
             <iframe
                 class="email-frame"
                 title={$_('filesharing.emailPreview.iframeTitle')}
-                srcdoc={active.html}
+                srcdoc={withBaseTarget(active.html)}
                 sandbox="allow-popups allow-popups-to-escape-sandbox"
             ></iframe>
         {/if}
