# XWUIMailHtmlBody

Renders an untrusted HTML email body inside a locked-down `<iframe>` (`sandbox="allow-same-origin"`, `referrerpolicy="no-referrer"`, plus an injected `Content-Security-Policy` meta) after passing the raw markup through `sanitizeEmailHtml()`, which strips scripts/forms/active CSS and screens every URL. Remote `http`/`https` images are withheld by default to defeat tracking pixels and read-receipts; when any are blocked it shows a "N remote images blocked for privacy. / Show images" status bar that re-renders with remote content enabled for that view only. The body markup comes from `data.html`, and behavior is tuned by `conf_comp` props `allowRemoteContent`, `stripTrackingPixels`, `showRemoteContentBar`, and the `onRemoteContentBlocked` callback. It is the secure body renderer composed by `XWUIMailReader` and `XWUIMailThread`.

## Usage

```ts
import { XWUIMailHtmlBody } from '@exonware/xwui/industry/email';

new XWUIMailHtmlBody(
  document.getElementById('app')!,
  { html: '<p>Hi team - see the <a href="https://example.com">report</a>.</p><img src="https://tracker.example/pixel.gif" width="1" height="1">' },
  { allowRemoteContent: false, stripTrackingPixels: true, showRemoteContentBar: true },
);
```

## Basic Usage

Render a sanitized HTML email body inside a locked-down iframe.

```example
file: examples/BasicUsage.ts
html: examples/BasicUsage.html
title: Basic Usage
description: Render a sanitized HTML email body inside a locked-down iframe.
```

## Blocked tracking pixel

Remote images are withheld by default, surfacing the "Show images" privacy bar.

```example
file: examples/BlockedTrackingPixel.ts
html: examples/BlockedTrackingPixel.html
title: Blocked tracking pixel
description: Remote images are withheld by default, surfacing the "Show images" privacy bar.
```

## Remote content allowed

A trusted newsletter where remote images load immediately, no privacy bar.

```example
file: examples/RemoteContentAllowed.ts
html: examples/RemoteContentAllowed.html
title: Remote content allowed
description: A trusted newsletter where remote images load immediately, no privacy bar.
```

```api
```