 
 formatMessage = (message) ->
     if message.html?
-        message.html = sanitizer.sanitize message.html, (value) ->
-            value.toString()
+        message.html = sanitizer.sanitize message.html, (url) ->
+            if 0 is url.indexOf 'cid://'
+                cid = url.substring 6
+                attachment = message.attachments.filter (att) ->
+                    att.contentId is cid
+
+                if name = attachment?[0].name
+                    return "/message/#{message.id}/attachments/#{name}"
+                else
+                    return null
+
+            else return url
 
     if not message.text?
         message.text = htmlToText.fromString message.html, htmlToTextOptions

            if message.isDraft
                if draftBox then Promise.resolve draftBox
                else Mailbox.findPromised account.draftMailbox
        else
                Mailbox.findPromised account.sentBox
        .throwIfNull ->
            new NotFound "Acount #{message.accountID} sent or draft box"


    # find the account and draftBox
    pAccount = pMessage.then (message) ->
        Account.findPromised message.accountID
    .throwIfNull -> new NotFound "Account #{message.accountID}"

    Promise.join pAccount, pMessage, pFiles, (account, message, files) ->
