server: sanitize html using ammonia

server/src/graphql.rs

@@ -243,7 +243,12 @@ impl QueryRoot {
                 .headers
                 .get_first_value("date")
                 .and_then(|d| mailparse::dateparse(&d).ok());
-            let body = extract_body(&m)?;
+            let body = match extract_body(&m)? {
+                Body::Html(Html { html }) => Body::Html(Html {
+                    html: ammonia::clean(&html),
+                }),
+                b => b,
+            };
             messages.push(Message {
                 from,
                 to,