Strings arriving from emails (such as senders, recipients, subjects, attachment names) or user properties (such as display name) may contain intentionally crafted html/javascript code to cause cross-site scripring.
These strings must all be html encoded before rendering to avoid execution of such code, and ensure that text is just visualized.
This must be done explicitly on various components, such as grids, combos, lists and message preview, because Sencha Ext GUI library does not do it automatically.