Raw view served an attachment inline with the Content-Type from the message,
only forcing PDF by file name. A part named photo.png declared as text/html is
previewed as an image by extension, and its link opened an HTML page on the
webmail origin. The raw CSP (script-src 'none'; child-src 'none') stopped
scripts, but replaced the global policy, so forms, meta refresh, base and
remote styles and images all worked: a convincing phishing page under the real
hostname.
- inlineContentType() allows only raster images, PDF, audio, video and
text/plain to be shown as declared. Other text/* is shown as text/plain (an
HTML attachment displays its source); anything else, SVG and XML included,
is sent as an application/octet-stream download.
- The raw CSP adds default-src 'none', form-action 'none' and base-uri 'none',
with explicit img, media, style and object sources for what raw view
legitimately shows. object-src 'self' keeps the browser PDF viewer usable
(not verified in a browser here).
test/raw-inline-type.php covers the type decision, parameters and case.
