fix: bubbling events from html message iframe

[madbob]

Issue: events occurring into the iframe rendering contents of an HTML message are absorbed by the iframe itself, and cannot be intercepted by the application. This breaks many frontend's behaviours once the user interact with the iframe itself (e.g. keyboard shortcuts do not work anymore once the user clicks on the message contents, and action menus do not close when incidentally clicking over the iframe).

With this change, some type of events are intercepted and replicated to the local DOM to be properly handled.
In details:

• keyup and keydown are consumed by vue-shortkey to handle keyboard shortcuts
• click is consumed by by NcActions to evaluate closing action menus (this specific change was already submitted in fix: actions menu for envelope #13296 but reverted to isolate and better evaluate this whole proposal)

Security implications: my understanding is that Mail strips Javascript from HTML of incoming messages. Which is, indeed, a sane practice applied by most web email clients. So, the risk of JS forged events escaping from the iframe is mitigated at his very root. A confirmation for this would be appreciated.

Fixes #6804

Summary by CodeRabbit

• Bug Fixes
  • Improved interaction handling for content displayed in embedded frames.
  • Clicks and keyboard actions within embedded content are now properly detected by the surrounding application.

[ChristophWurst]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

MessageHTMLBody.vue now forwards click, keydown, and keyup events from the message iframe to the parent document by cloning and re-dispatching them.

Changes

Message event forwarding

Layer / File(s)	Summary
Iframe event propagation src/components/MessageHTMLBody.vue	onMessageFrameLoad registers listeners for selected iframe events, clones each event, and dispatches it on the parent document.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: christophwurst, kesselb, gretad

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: forwarding bubbled events from the HTML message iframe.
Linked Issues check	✅ Passed	The added keydown, keyup, and click forwarding addresses the Delete shortcut failing after interacting with mail content.
Out of Scope Changes check	✅ Passed	The diff stays focused on iframe event forwarding and does not introduce unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a63139d1-b61f-41da-9101-34546152271a

📥 Commits

Reviewing files that changed from the base of the PR and between da344a0 and 283938f.

📒 Files selected for processing (1)

• src/components/MessageHTMLBody.vue