From b435ab44b044ada6837f3ca3b8e52f940c239456 Mon Sep 17 00:00:00 2001
From: saiththerobo <the.tom.sharp@gmail.com>
Date: Tue, 2 Jun 2026 12:39:56 +0100
Subject: [PATCH] fix: strip <style> tags from quoted HTML to prevent CSS
 leaking into app UI

---
 frontend/src/components/ComposeModal.jsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/ComposeModal.jsx b/frontend/src/components/ComposeModal.jsx
index fc8daf19..82f2a2a5 100644
--- a/frontend/src/components/ComposeModal.jsx
+++ b/frontend/src/components/ComposeModal.jsx
@@ -335,7 +335,9 @@ export default function ComposeModal() {
   // Initialise quoted HTML contentEditable once on mount (ref-based to avoid React cursor conflicts)
   useEffect(() => {
     if (quotedHtmlRef.current && quotedBodyHtml) {
-      quotedHtmlRef.current.innerHTML = DOMPurify.sanitize(quotedBodyHtml);
+      // FORBID_TAGS: strip <style> blocks — marketing emails use global rules like
+      // "div { margin: 0 !important }" that leak out of contentEditable into the app UI.
+      quotedHtmlRef.current.innerHTML = DOMPurify.sanitize(quotedBodyHtml, { FORBID_TAGS: ['style'] });
     }
   }, []); // eslint-disable-line react-hooks/exhaustive-deps