I think sanitizing email is a solved problem with this:
https://github.com/cure53/DOMPurify
I'm not the author but I've used it in the past. According to the readme it is what Fastmail uses.
https://github.com/cure53/DOMPurify
I'm not the author but I've used it in the past. According to the readme it is what Fastmail uses.
The reference we test against, by the way, is Mike Cardwell's excellent Email Privacy Tester:
https://emailprivacytester.com/