SecureLink.js is a lightweight client-side enforcement script for HTML5 emails. It ensures safe link navigation by blocking unsafe URL schemes and enforcing secure behavior for external links.
HTML5 emails can include links that trigger unsafe navigation, execute inline JavaScript, or break out of sandboxed environments. SecureLink.js helps enforce consistent, secure link behavior at runtime.
Developed by Email 5 as part of the Open Email Standards security layer.
- Blocks unsafe URL schemes:
javascript:data:file:
- Allows safe schemes:
http:https:mailto:tel:
- Forces
target="_blank"onhttpandhttpslinks - Ensures
rel="noopener noreferrer"is present - Prevents links from opening inside the email iframe
mailto:andtel:links are preserved without modification- Unsupported schemes are removed
- Unsafe links are disabled using
aria-disabled
- Uses
MutationObserverto monitor DOM changes - Handles dynamically added or modified links
- Maintains an audit log at
window.SecureLink.blocked - Optional
postMessageintegration with parent frame
SecureLink.js requires a JavaScript-enabled rendering environment with:
MutationObserverquerySelectorAll- standard DOM APIs
It is designed for sandboxed HTML5 email environments and is not intended for legacy email clients without JavaScript support.
Edit the CONFIG object inside the script:
const CONFIG = {
parentOrigin: "*"
};Production deployments should restrict parentOrigin to the trusted origin of the hosting email client.
Include the script in the email rendering environment:
<script src="SecureLink.js"></script><iframe
sandbox="allow-scripts"
srcdoc='
<!doctype html>
<html>
<head>
<script src="proxy.php?url=https%3A%2F%2Fgithub.com%2Fstagework%2FSecureLink.js"></script>
</head>
<body>
<a href="proxy.php?url=https%3A%2F%2Fexample.com">External link</a>
<a href="javascript:alert(1)">Unsafe link</a>
</body>
</html>
'>
</iframe>SecureLink.js scans all <a> elements and:
- Validates the URL scheme
- Removes or disables unsafe links
- Enforces secure navigation behavior for external links
- Monitors runtime changes continuously
Blocked events are stored in:
window.SecureLink.blockedSecureLink.js is a runtime enforcement layer and should be used alongside:
- HTML sanitization
- URL validation policies
- sandboxed iframe rendering
- strict script restrictions
It complements other Email 5 security modules by focusing specifically on link behavior.
SecureLink.js is part of the Email 5 client-side enforcement layer, alongside:
- ImageBlocker.js
- DownloadBlocker.js
- RedirectBlocker.js
Current release: v1.0
This project is licensed under the MIT License.