From 08f34b99546f636434c00525fb4f3123f86a4a08 Mon Sep 17 00:00:00 2001
From: djmaze <>
Date: Sun, 25 Oct 2026 23:28:14 +0100
Subject: [PATCH] @ZaphodB fix(security): message images loaded without consent
 through srcset and CSS The sanitizer sends img src, and url() in
 background-image, list-style-image and content, through the remote content
 handling: blocked until the user allows it, rewritten to the proxy when it is
 on. Two other ways to load an image were left alone:

- srcset (and sizes) were on the attribute allowlist and never rewritten, so
  <img srcset="https://..."> loaded when the message opened. With the proxy on,
  the CSP keeps img-src to 'self', but a relative srcset="?/ProxyExternal/<b64>"
  is same-origin and made the server fetch an attacker URL at render time: a
  read receipt with no click. With the proxy off the browser fetched directly.
- url() in any other style property (border-image-source, mask-image, filter,
  ...) kept its value, with the same two outcomes.

Drop srcset and sizes from the allowlist (attributes not on it are deleted),
and remove any other style property whose value holds url(). Relative img src
was already safe: anything not cid:, http(s) or data:image/ is parked as
data-x-src-broken.

Checked the style sweep in Chromium: border-image-source, mask-image (both
spellings), filter and cursor lose the url(), other declarations survive, and
the background/list-style shorthands are left to the existing handling.
---
 dev/Common/Html.js | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/dev/Common/Html.js b/dev/Common/Html.js
index 072045f9a..ebaa26bb0 100644
--- a/dev/Common/Html.js
+++ b/dev/Common/Html.js
@@ -283,7 +283,11 @@ export const
 				// hr
 				'noshade',
 				// img
-				'hspace', 'sizes', 'srcset', 'vspace',
+				// srcset and sizes are not allowed: only src goes through the
+				// remote content consent and proxy rewrite below, so a srcset
+				// URL loaded without asking (directly, or relative to this
+				// origin through ?/ProxyExternal as a read receipt).
+				'hspace', 'vspace',
 				// meter
 				'low', 'high', 'optimum', 'value',
 				// ol
@@ -578,6 +582,19 @@ export const
 				oStyle.color = delAttribute('color');
 			}
 
+			// Only the three properties below go through the remote content and
+			// cid: handling. A url() in any other property (border-image-source,
+			// mask-image, filter, ...) would load without consent, a relative one
+			// through ?/ProxyExternal on this origin, so drop those outright.
+			let i = oStyle.length;
+			while (i--) {
+				const property = oStyle[i];
+				if (!['background-image', 'list-style-image', 'content'].includes(property)
+				 && /url\s*\(/i.test(oStyle.getPropertyValue(property))) {
+					oStyle.removeProperty(property);
+				}
+			}
+
 			if (!skipStyle) {
 /*
 				if ('fixed' === oStyle.position) {