I would like to show email content on a webApp but would like to prevent js execution and loading resources that are not embedded(base64). Is there a feature that can disable such things on an iframe or some thing like that? Or do i need to parse and remove unwanted data by myself (Really not my favorit thing to do and will be a hard to keep it working properly.)?

To prevent JS execution i can use the sandbox attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox

But i don't know how i can prevent access to external resources (Images, Audio, CSS, ...) in an easy way. I could parse and modify the content but that sounds like a good way to mess up the security aspect of my goal ^^.