djmaze
08f34b9954
@ZaphodB fix(security): message images loaded without consent through srcset and CSS
...
The sanitizer sends img src, and url() in background-image, list-style-image
and content, through the remote content handling: blocked until the user
allows it, rewritten to the proxy when it is on. Two other ways to load an
image were left alone:
- srcset (and sizes) were on the attribute allowlist and never rewritten, so
<img srcset="https://..."> loaded when the message opened. With the proxy on,
the CSP keeps img-src to 'self', but a relative srcset="?/ProxyExternal/<b64>"
is same-origin and made the server fetch an attacker URL at render time: a
read receipt with no click. With the proxy off the browser fetched directly.
- url() in any other style property (border-image-source, mask-image, filter,
...) kept its value, with the same two outcomes.
Drop srcset and sizes from the allowlist (attributes not on it are deleted),
and remove any other style property whose value holds url(). Relative img src
was already safe: anything not cid:, http(s) or data:image/ is parked as
data-x-src-broken.
Checked the style sweep in Chromium: border-image-source, mask-image (both
spellings), filter and cursor lose the url(), other declarations survive, and
the background/list-style shorthands are left to the existing handling.
2026-10-25 23:28:14 +01:00
the-djmaze
8667af700d
Improved font-size handling to prevent issue #1082
2026-10-20 16:25:00 +02:00
Andrew Tjia
e16d0b52ae
Update Html.js to remove x-html tags before rendering
...
Fix for https://github.com/the-djmaze/snappymail/issues/1860 to remove <x-html></x-html> tags that might be emitted by certain email clients.
Tested by modifying locally using JS debugger and Snappymail JS debug mode.
2024-12-07 09:37:33 +09:00
the-djmaze
66553a36da
Improvements for #1846
2024-11-18 16:00:03 +01:00
the-djmaze
d6ef5ff70a
Squire paste image working again.
...
https://github.com/the-djmaze/snappymail/issues/1389#issuecomment-2389678680
2024-10-06 17:32:47 +02:00
the-djmaze
f7f8d2d542
Bugfix the new msgId handling due to Squire sanitizeToDOMFragment using cleanHTML
2024-10-01 18:05:26 +02:00
the-djmaze
f43c2c92b5
Squire sanitizeToDOMFragment use cleanHTML
2024-09-30 17:01:50 +02:00
the-djmaze
85ac404722
Drop support for noembed and noframes
...
Also remove everything after `<` inside `<style>`
2024-09-24 16:09:38 +02:00
the-djmaze
cfbc47488a
cleanHtml use allowedTags instead of disallowedTags and improved CSS handling
2024-09-16 14:37:26 +02:00
the-djmaze
8fb7067531
Added option to convert HTML to Markdown instead of plain, using Turndown #1604
2024-09-14 14:00:36 +02:00
the-djmaze
6ebf273390
Resolve #1724
2024-08-28 00:24:28 +02:00
the-djmaze
59652d2d61
Mark images with width=1 as tracking pixel
2024-08-26 13:22:41 +02:00
the-djmaze
6a1b83b365
Resolve #1678
2024-08-20 16:30:25 +02:00
the-djmaze
d00c953c88
Change handling of (token) errors due to #1706
2024-08-16 22:05:15 +02:00
the-djmaze
aa52d2e8f8
Resolve #1689
2024-08-06 17:50:43 +02:00
the-djmaze
e4316e6665
Resolve #1666
2024-07-15 19:27:48 +02:00
the-djmaze
50e30dbb6e
Slightly modified patch code of #1657
2024-07-11 01:31:58 +02:00
the-djmaze
e867000ff7
Idea for #1641
2024-06-24 12:26:48 +02:00
the-djmaze
614715f398
Resolve #1641
2024-06-23 12:31:08 +02:00
the-djmaze
53a6f04f18
Added "copy to" action in menu's for #1559
2024-04-28 17:32:25 +02:00
the-djmaze
bcc2c7b9ca
Prevent Infinity #1540
2024-04-08 17:22:27 +02:00
the-djmaze
d59a326920
Bugfix: hide pagination when search has 0 messages
2024-04-08 16:14:30 +02:00
the-djmaze
3988ea9ba5
cleanup unused js parameters
2024-04-03 00:15:29 +02:00
the-djmaze
78178ecc2f
Everything to ES2020
2024-04-02 22:24:53 +02:00
the-djmaze
7450afeecf
Replace all new Intl.Collator with new baseCollator
2024-03-19 15:24:34 +01:00
the-djmaze
9bc56a5abd
Ask old login password on CryptKey decrypt failure, to reseal with new password
2024-03-18 12:25:24 +01:00
the-djmaze
8e6f35bfad
Improved some AppData handling
2024-03-07 01:16:58 +01:00
the-djmaze
8fe5cd3c95
update mime types
2024-03-06 01:22:49 +01:00
the-djmaze
c8ea6fd2aa
Removed TODO as mentioned in #1473
2024-03-04 19:48:57 +01:00
the-djmaze
c1b7d37663
Simplify language Notifications
2024-03-01 01:39:00 +01:00
the-djmaze
14bee5d3bd
new Error() to Error()
2024-02-28 19:46:21 +01:00
the-djmaze
57ce6f9bbf
Fix timestampToString() for future dates
2024-02-25 13:11:17 +01:00
the-djmaze
10ec90435d
Show certificate icon for p12 and pfx files
2024-02-19 18:51:52 +01:00
the-djmaze
a9b60a762f
Also mark p7m with certificate icon
2024-02-19 15:29:25 +01:00
the-djmaze
f53d9ed6c3
Verify S/MIME signed messages #259
2024-02-19 15:14:11 +01:00
the-djmaze
2a14566679
friendlySize() could return NaN
2024-02-13 10:50:31 +01:00
the-djmaze
905315b164
Bugfix: friendlySize() failed on 0
2024-02-12 20:03:06 +01:00
the-djmaze
ea55eb13e5
Centralize loading of accounts and identities
2024-02-11 16:40:35 +01:00
the-djmaze
d1154df74d
Resolve #1415
2024-02-08 18:48:54 +01:00
the-djmaze
d55ce60cc5
Resolve #1225 by using optional link tracking
2024-02-06 16:05:17 +01:00
the-djmaze
be633f78a7
Add some basic support for Linked Data (Structured Email) #1422
2024-02-05 14:52:23 +01:00
the-djmaze
809fca73a0
Extract WYSIWYG code from Html.js into HtmlEditor.js
2024-02-05 14:10:58 +01:00
the-djmaze
2084913a4d
Rename moment to time as it has nothing todo anymore with momentjs
...
Change some observables to static as they never change later
2024-02-05 01:15:05 +01:00
the-djmaze
9eb5646aec
Redesign WYSIWYG handling to allow any editor (quill, tiny, etc. etc.)
2024-01-30 18:16:39 +01:00
the-djmaze
2916583d0b
Resolve #1332
2023-12-11 23:46:45 +01:00
the-djmaze
fa15ff6ba4
Draft idea for custom notification sounds
2023-12-05 16:18:36 +01:00
the-djmaze
7e30c50dfe
Merge viewPopupMessage() into popupMessage()
2023-12-01 23:00:39 +01:00
the-djmaze
daf1e2769f
Resolve #1289
2023-11-27 15:07:02 +01:00
the-djmaze
5cdbba8da0
Support \noinferiors to disallow creating subfolders
2023-11-22 04:07:57 +01:00
Sergey Mosin
4b26317be8
fix: '#/mailbox/folder/mUID/search' URI does not show the message
2023-11-07 09:34:21 -05:00
