Inserting raw HTML signature in account settings strips it of styles

[OrakMoya]

Steps to reproduce

1. Insert raw HTML signature featuring inline styles into the Rich Text signature editor, using the "Source" element.
2. Save and open new message

Expected behavior

The provided HTML is inserted verbatim into the end of the new message

Actual behavior

The provided HTML is stripped of inline styles and converted into a much more basic version, with incorrect layouts and styling.

Mail app version

5.11.5

Nextcloud version

34.0.1

Mailserver or service

Docker Mailcow

Operating system

Nextcloud AIO

PHP engine version

No response

Nextcloud memory caching

No response

Web server

No response

Database

No response

Additional info

No response

[odzhychko]

I could reproduce it. It also remove class names so <style/> also do not work. For example, this

<p style="color: #0082c9; font-size: 16px; letter-spacing: 2px;">Test Inline Style</p>
<style>
  .sig { color: #0082c9; font-size: 16px; letter-spacing: 2px; }
</style>
<p class="sig">Test Style Tag</p>

becomes

<p style="margin:0;">
    Test Inline Style
</p>
<style>
  .sig { color: #0082c9; font-size: 16px; letter-spacing: 2px; }
</style>
<p style="margin:0;">
    Test Style Tag
</p>

The same issues exists when inserting raw HTML as source of a mail and sending it.

I agree with the expected behavior of inserting it verbatim to the end of the new message.
Normal sanitization for <script>s etc. can apply, but should apply directly after pasting it into the signature editor.

[kesselb]

Explanation why we do not allow the complete html set: #12269 (comment) and https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html#configuration.

[odzhychko]

I see. Then this more like a feature request.

Implementing it might involve extending CKEditor or not using it for source editing.
This might included disallowing going back to WYSIWYG editor once source includes unsupported HTML.