From 5105f6d4c1d8db4ba7b413126575595c51857555 Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Tue, 14 Feb 2023 15:21:43 +0100
Subject: [PATCH] Improved handling of secure message `<style>` CSS class names

---
 dev/Common/CSS.js    |  8 +++++---
 dev/Common/Html.js   | 29 ++++++++++++++++-------------
 dev/Model/Message.js |  4 +---
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/dev/Common/CSS.js b/dev/Common/CSS.js
index 186e8a4f0..4e4d41879 100644
--- a/dev/Common/CSS.js
+++ b/dev/Common/CSS.js
@@ -27,11 +27,13 @@ export class CSS
 		 * Given css array, parses it and then for every selector,
 		 * prepends namespace to prevent css collision issues
 		 */
-		css.applyNamespace = (namespace) => css.forEach(obj => {
+		css.applyNamespace = (namespace, prefix) => css.forEach(obj => {
 			if (obj.type === 'media') {
-				obj.subStyles.applyNamespace(namespace);
+				obj.subStyles.applyNamespace(namespace, prefix);
 			} else {
-				obj.selector = obj.selector.split(',').map(selector => namespace + ' ' + selector).join(',');
+				obj.selector = obj.selector.split(',').map(selector =>
+					namespace + ' ' + selector.replace('.', '.'+prefix)
+				).join(',');
 			}
 		});
 
diff --git a/dev/Common/Html.js b/dev/Common/Html.js
index b84e739c1..b29f2e744 100644
--- a/dev/Common/Html.js
+++ b/dev/Common/Html.js
@@ -133,7 +133,7 @@ export const
 			},
 			allowedAttributes = [
 				// defaults
-				'name', 'class',
+				'name',
 				'dir', 'lang', 'style', 'title',
 				'background', 'bgcolor', 'alt', 'height', 'width', 'src', 'href',
 				'border', 'bordercolor', 'charset', 'direction',
@@ -171,6 +171,12 @@ export const
 				'A','B','EM','I','SPAN','STRONG'
 			];
 
+		if (SettingsUserStore.allowStyles()) {
+			allowedAttributes.push('class');
+		} else {
+			msgId = 0;
+		}
+
 		tpl.innerHTML = html
 			// Strip Microsoft comments
 			.replace(/<!--\[if[\s\S]*?endif\]-->/gi, '')
@@ -205,8 +211,11 @@ export const
 			if ('STYLE' === name) {
 				if (msgId) {
 					let css = new CSS().parse(oElement.textContent);
-					css.applyNamespace(msgId);
+					css.applyNamespace(msgId, 'msg-');
 					oElement.textContent = css;
+					if (SettingsUserStore.removeColors()) {
+						oElement.textContent = oElement.textContent.replace(/(background-)color:[^};]+/g, '');
+					}
 				} else {
 					oElement.remove();
 				}
@@ -225,29 +234,23 @@ export const
 				oElement.remove();
 				return;
 			}
-/*
-			// Idea to allow CSS
-			if ('STYLE' === name) {
-				msgId = '#rl-msg-061eb4d647771be4185943ce91f0039d';
-				oElement.textContent = oElement.textContent
-					.replace(/[^{}]+{/g, m => msgId + ' ' + m.replace(',', ', '+msgId+' '))
-					.replace(/(background-)color:[^};]+/g, '');
-				return;
-			}
-*/
+
 			const aAttrsForRemove = [],
+				className = oElement.className,
 				hasAttribute = name => oElement.hasAttribute(name),
 				getAttribute = name => hasAttribute(name) ? oElement.getAttribute(name).trim() : '',
 				setAttribute = (name, value) => oElement.setAttribute(name, value),
 				delAttribute = name => oElement.removeAttribute(name);
 
-			if ('mail-body' === oElement.className) {
+			if ('mail-body' === className) {
 				forEachObjectEntry(tasks, (name, cb) => {
 					if (hasAttribute(name)) {
 						cb(getAttribute(name), oElement);
 						delAttribute(name);
 					}
 				});
+			} else if (msgId && className) {
+				oElement.className = className.replace(/(^|\s+)/g, '$1msg-');
 			}
 
 			if (oElement.hasAttributes()) {
diff --git a/dev/Model/Message.js b/dev/Model/Message.js
index 8960306e9..0d62b73bc 100644
--- a/dev/Model/Message.js
+++ b/dev/Model/Message.js
@@ -25,9 +25,7 @@ import { LanguageStore } from 'Stores/Language';
 import Remote from 'Remote/User/Fetch';
 
 const
-	msgHtml = msg => cleanHtml(msg.html(), msg.attachments(),
-		SettingsUserStore.allowStyles() ? '#rl-msg-' + msg.hash : ''
-	),
+	msgHtml = msg => cleanHtml(msg.html(), msg.attachments(), '#rl-msg-' + msg.hash),
 
 	toggleTag = (message, keyword) => {
 		const lower = keyword.toLowerCase(),