force template html as html code, not an url or file path

ensure that external resources are not loaded by jsdom
Mailtrain-org · Mar 19, 2017 · 0879fa4 · 0879fa4
1 parent 9d5fb81
commit 0879fa4
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/lib/tools.js b/lib/tools.js
@@ -199,8 +199,13 @@ function prepareHtml(html, callback) {
     if (!(html || '').toString().trim()) {
         return callback(null, false);
     }
-
-    jsdom.env(html, (err, win) => {
+    jsdom.env(false, false, {
+        html,
+        features: {
+            FetchExternalResources: false, // disables resource loading over HTTP / filesystem
+            ProcessExternalResources: false // do not execute JS within script blocks
+        }
+    }, (err, win) => {
         if (err) {
             return callback(err);
         }