Heya,
We’d like to be able to disable loading of external assets in email files (ie. <img src="https://example.com/image.png">).
We are running GroupDocs Conversion for Java, in a Kubernetes environment with Cillium. For security reasons Cillium is configured to block any requests from the app out to the internet - and we’d additionally like to prevent GroupDocs from trying to make any HTTP asset requests for security defence in depth.
I can see in EmailLoadOptions we can configure a zero-timeout via setResourceLoadingTimeout which prevents waits for the connection to timeout, however this doesn’t seem to actually prevent the HTTP calls from being attempted.
Is there a way that we can configure GroupDocs to not make these requests? Alternatively would this be a feature you would consider adding to the product such that we could setLoadExternalAssets on EmailLoadOptions or something similar?
Many thanks,
Dan
Hello @danielroy96 ,
Thank you for contacting us.
At the moment, the functionality you need for EmailLoadOptions is not available in the GroupDocs.Conversion for Java library.
We have discussed your use case with our development team, and they confirmed that they are interested in adding this capability in future versions of the product. Unfortunately, they will need some time for investigation, and there is currently no estimated timeframe for when this feature will be available.
We have registered your request in our tracking system under the ID CONVERSIONJAVA-3044, and we will keep you informed of any updates regarding this ticket.
1 Like
Glad to see this is being tracked! In the meantime, for anyone else running into this in a locked-down environment, have you tried implementing a custom IResourceLoader? I’ve seen others use that to intercept and block or ‘dummy out’ external URLs before the app even tries to reach the network. Might be a decent stop-gap until the official flag is added!
1 Like
Hello @EleenD09 and @danielroy96 ,
Our development team has already implemented a feature to disable loading external resources for email files. It will be available in the upcoming official release of GroupDocs.Conversion for Java 26.1, which is expected in the coming days. Below, I will demonstrate how you can use this functionality:
//To skip loading external resources during email conversion, set the SkipExternalResources property to true in EmailLoadOptions:
EmailLoadOptions loadOptions = new EmailLoadOptions();
loadOptions.setSkipExternalResources( true);
//When SkipExternalResources is set to true, all external resources (images, CSS, etc.) will be blocked. To allow specific resources, add them to the WhitelistedResources list:
EmailLoadOptions loadOptions = new EmailLoadOptions();
loadOptions.setSkipExternalResources(true);
loadOptions.setWhitelistedResources(Arrays.asList("trusted-domain.com", ".jpeg", ".png");
//Resources matching any entry in the whitelist will be loaded normally, while all other external resources will be skipped.
1 Like