[izikaj]

Motivation

The Sandbox body.html endpoint will return the HTML that the Sandbox preview shows, not the email as it was sent. Mailtrap sanitizes it for preview: scripts and stylesheet links are removed, @import rules are disabled, and entities are escaped. A test that reads a link from body.html gets ...?token=abc&user=1 instead of ...?token=abc&user=1.

The spec still says "formatted HTML email body", and its example is the same document as the body.htmlsource example. A new X-Blocked-Content response header reports what the sanitizer removed, and the spec does not document it.

Merge this PR when the sanitized response goes live, not before.

Changes

• body.html: describe the sanitized response
  • a full HTML document, with a script-src 'none' CSP meta tag first in head
  • entities escaped (& becomes &)
  • scripts and stylesheet links removed (Google Fonts links stay), @import renamed to @x-import
  • links get target="_blank" and rel="noopener noreferrer"
  • if sanitizing fails, 200 with a placeholder page and X-Blocked-Content: unparseable=1
• body.html: point to body.htmlsource for the email as it was sent, for example to read links in tests
• body.html: add the X-Blocked-Content header, which holds comma-separated type=count pairs with the types script, stylesheet, css_import and unparseable
  • only a script that loads an external file is counted; inline scripts are removed but not counted
  • css_import is an upper bound: it counts every disabled @import, also one under a media query and one that the browser ignores
  • the header is absent if nothing was blocked, and the order of the pairs is not fixed
• body.html: replace the example with the real sanitizer output for the body.htmlsource example
• body.htmlsource: add a confirm link with a raw &, a stylesheet link, an external script and an @import to the example, so the two examples show the same email before and after sanitizing; describe it as the HTML body as it was sent

How to test

• The "Get HTML message" page shows the new description, the info hint that points to body.htmlsource, and the X-Blocked-Content header on the 200 response
• In the body.html example, the confirm link has & and the @import is @x-import; in the body.htmlsource example, they are as sent
• npx @redocly/cli lint specs/sandbox.openapi.yml reports no new problems compared to main

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Clarified that the HTML source endpoint returns the submitted HTML, while the HTML body endpoint returns a sanitized preview rather than the sent message.
  • Documented preview transformations, blocked-content reporting, and the placeholder response used when sanitization fails.
  • Updated examples to show external resources, confirmation links, and sanitized preview output.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d2835d0e-2321-45c2-b3f4-d4b0a1544d78

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 66de24a9-58df-4074-887f-c54a6216d039

📥 Commits

Reviewing files that changed from the base of the PR and between 4e2f059 and 82eeb0e.

📒 Files selected for processing: 1

• specs/sandbox.openapi.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The OpenAPI specification now distinguishes the sent HTML body from the sanitized HTML preview. It documents preview sanitization, blocked-content reporting, and failure handling, and updates examples for both endpoints.

Changes: HTML endpoints

Layer / File(s)	Summary
HTML endpoint contracts and examples specs/sandbox.openapi.yml	The source endpoint documentation describes the HTML body as sent and updates its example. The preview endpoint documentation describes sanitization and failure handling, and updates its example to show the sanitized full document.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: mklocek

Merge Risk: ⚪ Minimal · up to 82eeb

The specification describes sanitized preview behavior, and its examples align. No concrete mismatch or actionable merge risk is established by this documentation change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the primary changes: documenting the sanitized Sandbox body.html response and the X-Blocked-Content header.
Description check		The description is complete and directly related to the changes. It includes motivation, detailed changes, testing steps, and the merge condition. The optional Images and GIFs section is not included,…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is complete and directly related to the changes. It includes motivation, detailed changes, testing steps, and the merge condition. The optional Images and GIFs section is not included, but this does not prevent review of the documentation update.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}