Email Sender (Labs) node appears to sanitise table tags

Hi

I’m trying to look at using the newer Email Sender (Labs) node instead of the Send Email node.

I want to be able to include a table in the email, ideally the one generate by the Lhasa Table to HTML String node.

The documentation says

If this entire message is controlled via flow variable assignment, e.g. via the control button on the top right of the editor, the value is interpreted as HTML. Specifically any occurrence of HTML tags is interpreted unless it is escaped. For instance, a value such as <b> Message </b>will mark Messagein bold. If that is not desired, reformat the variable value and escape it, i.e. as &lt;b&gt; Message &lt;/b&gt;. If the message is sent as Text (see Content Type below), any HTML-like tag is removed (stripped) from the value.

However, this does not seem to be entirely correct. I can indeed get bold text with <b>Message</b> but it looks like the table tags are being stripped before sending the email.

What I see in the email:

column1 column2 test1test22test33

The HTML I passed in via a flow variable


		<table style="border:1px solid black">
			<tr style=" background-color: black; color: white; padding-top: 5px; padding-bottom: 5px; padding-left: 5px; padding-right: 5px">

				<th> <b> column1 </b> </th>
				<th> <b> column2 </b> </th>
			</tr>
			<tr style="padding: 0px;background-color: #f2f2f2;">
				<td style="border: 1px solid #ddd;">test</td>
				<td style="border: 1px solid #ddd;">1</td>
			</tr>
			<tr style="padding: 0px;">
				<td style="border: 1px solid #ddd;">test2</td>
				<td style="border: 1px solid #ddd;">2</td>
			</tr>
			<tr style="padding: 0px;background-color: #f2f2f2;">
				<td style="border: 1px solid #ddd;">test3</td>
				<td style="border: 1px solid #ddd;">3</td>
			</tr>
		</table>

Is this intended behaviour?

Cheers

Sam

Hi @swebb,

it looks like table elements are not part of the HTML sanitization allowlist: knime-email/org.knime.email/src/org/knime/email/nodes/sender/EmailSender.java at master · knime/knime-email · GitHub

Based on the source code, I think we need to add them like in the pre-canned sanitizers: java-html-sanitizer/owasp-java-html-sanitizer/src/main/java/org/owasp/html/Sanitizers.java at f729a089b20aef49ed9ffd7ed1c7e207eee71dc5 · OWASP/java-html-sanitizer · GitHub

I opened an internal ticket (AP-24111) but cannot promise when we are able to fix it.

3 Likes

Maybe attaching the table as a Table View via the new Reporting is a workaround in the meantime? I think the table can also be put in the Email inline and not only as an attachment.

1 Like

I’ll give it a go and thanks for looking into the issue and suggesting a work around :slight_smile:

Here is an example: Send Report by Email – KNIME Community Hub
Look at the last node of the workflow.

2 Likes