139 mailbox XSS vulnerability and repair

139 mailbox XSS vulnerability, send an email to death, should be able to crawl. One of the two controllable write parts does not seem to be completely filtered, and the other one only filters the quotation marks. It seems that it can be crawled and the level is not enough. I looked at other mailboxes. NetEase, gmail, and qq do not seem to have been filtered here, but they are not constructed and fail. Let's take a look at it ~
Description: The problem is that the sender and email are displayed.
 
 



 
Figure box part ~
This part of content is controllable. After studying smtp, the displayed sender and recipient can be forged. It has nothing to do with the actual sender, the test code used <iframe onload = alert (/a/);>. Some quotation marks and <> are added before and after the test code to check whether the blocked content is too descriptive, you can study other email systems.
 
Solution:

Filter? Escape?

The author has a final feeling