Render HTML message in iFrame

Note that an iframe from the same domain is not a full isolation.
The problem is mitigate a big by the fact that we show mostly outgoing mails and not random incoming mails.

Other systems identified the need for full isolation to deliver the iframe from a different domain to clarify the CORS (cross domain) situation.

As soon as a user payload could end up in the mail, this could cause a security issue.
I guess then this would need to be an opt-in with some warning?

Ok, agreed, this might be a risk. Is this also true with the sandbox attribute present on the iframe? That disables things like scripts, forms and downloads: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe But yeah, that aren't all the possible attack vectors.

Ok, this is also broken with symfony_mailer.