warning message spans may appear in sent email

[lsloan]

I may be sounding the alarm too soon, but I thought I'd mention a problem I found before somebody else does. If it turns out to be my own fault and this is proven to be a non-issue, then so be it.

I sent myself a message in Google Mail (my organization uses an enterprise version set up for us by Google) which contained only the word "sorry" followed by my email signature. When I opened the message I'd received, then chose the Show original feature, the "text/html" part of the message contained the following:

<div dir=3D"ltr"><div><span title=3D"Using "sorry" frequently und=
ermines your gravitas and makes you appear unfit for leadership. --Sylvia A=
nn Hewlett"><span title=3D"Using "sorry" frequently undermines yo=
ur gravitas and makes you appear unfit for leadership. --Sylvia Ann Hewlett=
">sorry</span></span></div><div><br><div><div><div><div dir=3D"ltr"><=
div><div dir=3D"ltr"><div dir=3D"ltr"></div></div></div></div></div></div>
</div></div></div>

(I've edited this slightly to remove my email signature and its immediately enclosing markup.)

Notice there are two HTML span elements which contain JNS warning messages about using the word "sorry". This could be embarrassing if some recipient noticed this in a message.

I had installed JNS by downloading a ZIP file of this repo, extracting it on my computer (running OS X v10.11.1), and using the Load unpacked extension... button on extensions page in Chrome ("Version 47.0.2526.106 (64-bit)"). I ran it and it seemed fine.

I went on to make some minor changes to just-not-sorry.css. To see them, I used the Reload (⌘R) link on the extensions page to reload my changes. They didn't appear at first, so I also reloaded my Google Mail page. In my "Drafts" folder, I reopened the message and made some edits to the message to see the new style I'd specified. It looked fine, so I sent the message.

I didn't suspect that the JNS message would appear in my email at all. I just happened to inspect the elements of the message and I noticed it there.

I suspect that the markup may have gotten included in the message because I reloaded the page while JNS had the text highlighted. It might also have something to do with the enterprise version of Google Mail I'm using. I'd like to know whether anybody else can reproduce this problem, either with the GitHub project or using the extension installed from Chrome's web store.

Let me know if more details are needed.

[tami-cyrus]

Thanks! We'll review this tomorrow.
Do you know what Chrome version you are using?
Do you have any other gmail plugins installed?

Tami Reiss
CEO
Cyrus Innovation http://www.cyrusinnovation.com/
212-647-7186

Agile Reinforcement to accelerate your development

Dedicated to respect and diversity

@tamireiss / @cyrusinnovation

Learn about the difference between the Cyrus way
http://www.cyrusinnovation.com/differences-between-xp-vs-scrum-agile/ and
other consultancies.

On Wed, Jan 6, 2016 at 1:14 PM, Lance E Sloan notifications@github.com
wrote:

I may be sounding the alarm too soon, but I thought I'd mention a problem
I found before somebody else does. If it turns out to be my own fault and
this is proven to be a non-issue, then so be it.

I sent myself a message in Google Mail (my organization uses an enterprise
version set up for us by Google) which contained only the word "sorry"
followed by my email signature. When I opened the message I'd received,
then chose the Show original feature, the "text/html" part of the message
contained the following:

<= div>

(I've edited this slightly to remove my email signature and its
immediately enclosing markup.)

Notice there are two HTML span elements which contain JNS warning
messages about using the word "sorry". This could be embarrassing if some
recipient noticed this in a message.

I had installed JNS by downloading a ZIP file of this repo, extracting it
on my computer (running OS X v10.11.1), and using the Load unpacked
extension... button on extensions page in Chrome ("Version 47.0.2526.106
(64-bit)"). I ran it and it seemed fine.

I went on to make some minor changes to just-not-sorry.css. To see them,
I used the Reload (⌘R) link on the extensions page to reload my changes.
They didn't appear at first, so I also reloaded my Google Mail page. In my
"Drafts" folder, I reopened the message and made some edits to the message
to see the new style I'd specified. It looked fine, so I sent the message.

I didn't suspect that the JNS message would appear in my email at all. I
just happened to inspect the elements of the message and I noticed it there.

I suspect that the markup may have gotten included in the message because
I reloaded the page while JNS had the text highlighted. It might also have
something to do with the enterprise version of Google Mail I'm using. I'd
like to know whether anybody else can reproduce this problem, either with
the GitHub project or using the extension installed from Chrome's web store.

Let me know if more details are needed.

—
Reply to this email directly or view it on GitHub
#12.

[lsloan]

Chrome version: Version 47.0.2526.106 (64-bit)

The only other Google Chrome extension for Google Mail I have installed is "Google Mail Checker 4.4.0", but I had disabled it several weeks ago.

[lsloan]

I was able to reproduce this with a few simple steps:

Reproduction 1

1. Remove all other versions of JNS (older copies, local dev. versions, etc.)
2. Install JNS from Chrome Web Store.
3. In Google Mail, start composing message to myself.
4. Body of message contains, "just sorry: using ext. from store, started compose, then reloaded GMail window", and no other text (no email signature, etc.)
5. Click the page reload button for Google Chrome.
6. After page reloads, the previous compose session should resume. Click the "Send" button.
7. View the just-received message. Click the "Show original" option.
8. See the JNS messages embedded in the email:

<div dir=3D"ltr"><div><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=
=3D"ltr"><div><span title=3D"&quot;Just&quot; demeans what you have to say.=
 &quot;Just&quot; shrinks your power. It&#39;s time to say goodbye to the j=
usts. --Tara Sophia Mohr">just</span>=C2=A0<span title=3D"Using &quot;sorry=
&quot; frequently undermines your gravitas and makes you appear unfit for l=
eadership. --Sylvia Ann Hewlett">sorry</span>: using ext. from store, start=
ed compose, then reloaded GMail window</div></div></div></div></div></div><=
/div>
</div>

[lsloan]

Update: Just now I found a simpler set of steps to reproduce the problem. No reload trickery necessary:

Reproduction 2

1. In Google Mail, start composing a reply to an existing message.
2. Body of message contains a JNS keyword, "trying". The message also contained my email signature and a quoted copy of the message to which I was replying.
3. When I was finished writing my message, I send the message the way I usually do, by pressing ⌘Enter (⌘Return works, too).
4. View the just-sent message. Click the "Show original" option.
5. See the JNS messages embedded in the email.

I'm not including the example results here, since it contains business information.

Note that while the JNS spans are included in the message, they are not styled. There's no red dotted underline visible. However, the JNS messages are still visible in the source and may appear under other circumstances as well.

It seems that this case can only be reproduced by using the send keystroke combination, ⌘Enter. When clicking the Send button, JNS appears to have time to remove the spans.

[lsloan]

I hope you're not getting too annoyed with my updates. (Just the right amount of annoyance is fine, though.)

As I mentioned before, my Google Mail account is an "enterprise" one. To make the test more bulletproof, I switched to my personal, non-enterprise account. I also created a new Chrome profile that only has the JNS extension enabled and nothing else. Even with this minimal setup, I was able to reproduce the issue as described in each of the two sets of reproductions shown above.

There are a couple of new observations, though:

1. The steps in "Reproduction 2" only work when composing a reply to an existing message. I tried sending a new message with ⌘Enter and it didn't include the JNS spans. With new messages, only the steps in "Reproduction 1" cause them to include the spans.
2. I found that email sent as a reply to another message, following the steps in "Reproduction 2", actually does include the attribute class="jns-warning" in the JNS spans. However, Google Mail seems to strip the class out before displaying, probably for security reasons. If the classes weren't stripped before display, the underlines will appear if the recipient also has JNS installed. The spans with classes can be seen in the email source by using the "Show original" option:

<div dir=3D"ltr"><span class=3D"jns-warning" title=3D"&quot;Just&quot; deme=
ans what you have to say. &quot;Just&quot; shrinks your power. It&#39;s tim=
e to say goodbye to the justs. --Tara Sophia Mohr">just</span>=C2=A0like th=
at<br><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Thu, Jan=
 7, 2016 at 10:29 AM, Lance Sloan <span dir=3D"ltr">&lt;<a href=3D"mailto:x=
xxxxxxxxxx@gmail.com" target=3D"_blank">xxxxxxxxxxx@gmail.com</a>&gt;</span> =
wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bord=
er-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><span title=3D"Us=
ing &quot;sorry&quot; frequently undermines your gravitas and makes you app=
ear unfit for leadership. --Sylvia Ann Hewlett"><span class=3D"jns-warning"=
 title=3D"Using &quot;sorry&quot; frequently undermines your gravitas and m=
akes you appear unfit for leadership. --Sylvia Ann Hewlett">sorry</span></s=
pan>=C2=A0<span class=3D"HOEnZb"><font color=3D"#888888"><br clear=3D"all">=
<div><br></div>-- <br><div>Lance E Sloan<div>&quot;...<span title=3D"&quot;=
Just&quot; demeans what you have to say. &quot;Just&quot; shrinks your powe=
r. It&#39;s time to say goodbye to the justs. --Tara Sophia Mohr"><span cla=
ss=3D"jns-warning" title=3D"&quot;Just&quot; demeans what you have to say. =
&quot;Just&quot; shrinks your power. It&#39;s time to say goodbye to the ju=
sts. --Tara Sophia Mohr">just</span></span> this guy, you know?&quot;</div>=
</div>
</font></span></div>
</blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div class=
=3D"gmail_signature">Lance E Sloan<div>&quot;...<span class=3D"jns-warning"=
 title=3D"&quot;Just&quot; demeans what you have to say. &quot;Just&quot; s=
hrinks your power. It&#39;s time to say goodbye to the justs. --Tara Sophia=
 Mohr">just</span> this guy, you know?&quot;</div></div>
</div></div>

So far, it appears that the text of JNS span messages is not searchable by Google Mail or the browser, but it could be searchable in other mail clients used by message recipients.

[lsloan]

I thought of a possible solution: Instead of altering the HTML of the email messages being edited, look into whether the Google Chrome extension APIs allows changing the appearance of page contents without affecting the markup. The spelling check feature seems to do this. It's just a question of whether an extension is allowed to make that kind of change.

It seems that when JNS changes the markup, Google Mail is saving it as part of the message. After it's saved, then some events (page reload, sending with a keystroke, maybe others) prevent JNS from removing the spans.

[tami-cyrus]

We're working on the highlighting span issue tomorrow and we hope that it
alleviates the changes. Our engineers will comment on what fix they chose.
Thank you for the suggestions.

Tami Reiss
CEO
Cyrus Innovation http://www.cyrusinnovation.com/
212-647-7186

Agile Reinforcement to accelerate your development

Dedicated to respect and diversity

@tamireiss / @cyrusinnovation

Learn about the difference between the Cyrus way
http://www.cyrusinnovation.com/differences-between-xp-vs-scrum-agile/ and
other consultancies.

On Thu, Jan 7, 2016 at 11:28 AM, Lance E Sloan notifications@github.com
wrote:

I thought of a possible solution: Instead of altering the HTML of the
email messages being edited, look into whether the Google Chrome extension
APIs allows changing the appearance of page contents without affecting the
markup. The spelling check feature seems to do this. It's just a question
of whether an extension is allowed to make that kind of change.

It seems that when JNS changes the markup, Google Mail is saving it as
part of the message. After it's saved, then some events (page reload,
sending with a keystroke, maybe others) prevent JNS from removing the spans.

—
Reply to this email directly or view it on GitHub
#12 (comment)
.

[tami-cyrus]

We're hoping that #31 fixes this