Only allow email attachments inside of EMAIL_ATTACHMENT_ROOT

[gavinwahl]

This can limit the scope of vulnerabilities created by incorrect escaping in YAML templates. This could be backwards incompatible if you are including attachments outside of EMAIL_ATTACHMENT_ROOT, but I don't think anyone is doing this.

[acatton]

I feel like this is sweeping the problem under the rug. The real problem here is that we have to escape everything in the email header. I'm working on a more general fix.

@davesque

[gavinwahl]

It has to be escaped by you in the template -- templating YAML is difficult. There's not an automatic way to escape something you're going to embed in YAML.

[acatton]

After going through the code and trying to fix the way I want. I don't see any simple solution not breaking backward compatibility. I thing this is mergable.

But still, putting yaml like that can lead to issues. Even if we use |escapejs filter, having a colon sign will raise a YAML parsing error.