fix: enabling html ids inside email body to permit css targetting

[madbob]

Examining the samples provided in #9976, and in particular this one, I've found that the original message includes CSS style targetting IDs inside the HTML body itself.

By default HTMLPurifier strips IDs, as it is considered unsafe to keep them and risk conflicts with IDs already existing in the web application embedding the manipulated HTML. But in Mail the full email body is confined into an iframe, so no clashing is expected to happen.

Fixes #9976

Summary by CodeRabbit

• Bug Fixes
  • HTML email content now preserves permitted ID attributes during sanitization.

[ChristophWurst]

Thanks!

[ChristophWurst]

@CodeRabbit review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0414a69c-f95c-409e-85cb-b20bb8fdbb49

📥 Commits

Reviewing files that changed from the base of the PR and between de6c0dd and 2aae319.

📒 Files selected for processing (1)

• lib/Service/Html.php

---

📝 Walkthrough

Walkthrough

HTMLPurifier now preserves and processes element id attributes when sanitizing mail bodies.

Changes

HTML sanitization

Layer / File(s)	Summary
Enable HTML ID attributes lib/Service/Html.php	sanitizeHtmlMailBody enables HTMLPurifier's Attr.EnableID setting.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to 2aae3

This is a localized change to preserve HTML IDs in email bodies for CSS targeting; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: christophwurst, kesselb

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes enabling HTML IDs in email bodies, which matches the primary code change.
Linked Issues check	✅ Passed	The change directly supports issue #9976 by enabling email CSS targeting for improved font and background color rendering.
Out of Scope Changes check	✅ Passed	The pull request contains one targeted configuration change related to the linked email-rendering issue.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ChristophWurst]

Makes sense and can't think of a way that these IDs break anything outside the iframe.

@kesselb would appreciate a second review from you nonetheless

I'd also suggest a specific test for this in the style of

  public function testSanitizeHtmlMailBodyPreservesId(): void {
      $urlGenerator = $this->createStub(IURLGenerator::class);
      $request = $this->createStub(IRequest::class);
      $hmacGenerator = $this->createStub(ProxyHmacGenerator::class);

      $html = new Html($urlGenerator, $request, $hmacGenerator);

      $result = $html->sanitizeHtmlMailBody(42, '<p id="target">hello</p>', []);

      $this->assertStringContainsString('id="target"', $result);
  }

[madbob]

Pushed the extra test (thanks!)