djmaze
fcf45b51ac
Merge remote-tracking branch 'ghsa-crj4-pmx2-cxqm/advisory-fix-1'
2026-11-03 15:23:55 +01:00
the-djmaze
61a16e2e72
Remove unused old solution of #1641
2026-11-01 22:51:40 +01:00
the-djmaze
eb47ce41a3
Resolve #2089
2026-10-26 18:01:27 +01:00
the-djmaze
49f94a5650
Setting font-size was too aggressive
2026-10-26 17:41:10 +01:00
djmaze
08f34b9954
@ZaphodB fix(security): message images loaded without consent through srcset and CSS
...
The sanitizer sends img src, and url() in background-image, list-style-image
and content, through the remote content handling: blocked until the user
allows it, rewritten to the proxy when it is on. Two other ways to load an
image were left alone:
- srcset (and sizes) were on the attribute allowlist and never rewritten, so
<img srcset="https://..."> loaded when the message opened. With the proxy on,
the CSP keeps img-src to 'self', but a relative srcset="?/ProxyExternal/<b64>"
is same-origin and made the server fetch an attacker URL at render time: a
read receipt with no click. With the proxy off the browser fetched directly.
- url() in any other style property (border-image-source, mask-image, filter,
...) kept its value, with the same two outcomes.
Drop srcset and sizes from the allowlist (attributes not on it are deleted),
and remove any other style property whose value holds url(). Relative img src
was already safe: anything not cid:, http(s) or data:image/ is parked as
data-x-src-broken.
Checked the style sweep in Chromium: border-image-source, mask-image (both
spellings), filter and cursor lose the url(), other declarations survive, and
the background/list-style shorthands are left to the existing handling.
2026-10-25 23:28:14 +01:00
the-djmaze
8667af700d
Improved font-size handling to prevent issue #1082
2026-10-20 16:25:00 +02:00
Andrew Tjia
e16d0b52ae
Update Html.js to remove x-html tags before rendering
...
Fix for https://github.com/the-djmaze/snappymail/issues/1860 to remove <x-html></x-html> tags that might be emitted by certain email clients.
Tested by modifying locally using JS debugger and Snappymail JS debug mode.
2024-12-07 09:37:33 +09:00
the-djmaze
66553a36da
Improvements for #1846
2024-11-18 16:00:03 +01:00
the-djmaze
d6ef5ff70a
Squire paste image working again.
...
https://github.com/the-djmaze/snappymail/issues/1389#issuecomment-2389678680
2024-10-06 17:32:47 +02:00
the-djmaze
f7f8d2d542
Bugfix the new msgId handling due to Squire sanitizeToDOMFragment using cleanHTML
2024-10-01 18:05:26 +02:00
the-djmaze
f43c2c92b5
Squire sanitizeToDOMFragment use cleanHTML
2024-09-30 17:01:50 +02:00
the-djmaze
85ac404722
Drop support for noembed and noframes
...
Also remove everything after `<` inside `<style>`
2024-09-24 16:09:38 +02:00
the-djmaze
cfbc47488a
cleanHtml use allowedTags instead of disallowedTags and improved CSS handling
2024-09-16 14:37:26 +02:00
the-djmaze
8fb7067531
Added option to convert HTML to Markdown instead of plain, using Turndown #1604
2024-09-14 14:00:36 +02:00
the-djmaze
6ebf273390
Resolve #1724
2024-08-28 00:24:28 +02:00
the-djmaze
59652d2d61
Mark images with width=1 as tracking pixel
2024-08-26 13:22:41 +02:00
the-djmaze
e4316e6665
Resolve #1666
2024-07-15 19:27:48 +02:00
the-djmaze
e867000ff7
Idea for #1641
2024-06-24 12:26:48 +02:00
the-djmaze
614715f398
Resolve #1641
2024-06-23 12:31:08 +02:00
the-djmaze
d1154df74d
Resolve #1415
2024-02-08 18:48:54 +01:00
the-djmaze
d55ce60cc5
Resolve #1225 by using optional link tracking
2024-02-06 16:05:17 +01:00
the-djmaze
be633f78a7
Add some basic support for Linked Data (Structured Email) #1422
2024-02-05 14:52:23 +01:00
the-djmaze
809fca73a0
Extract WYSIWYG code from Html.js into HtmlEditor.js
2024-02-05 14:10:58 +01:00
the-djmaze
9eb5646aec
Redesign WYSIWYG handling to allow any editor (quill, tiny, etc. etc.)
2024-01-30 18:16:39 +01:00
the-djmaze
c60f8776f4
Resolve #1208
2023-08-29 16:08:24 +02:00
the-djmaze
4f3265f8b6
Resolve #1215
2023-08-28 17:44:07 +02:00
the-djmaze
037ed7e257
Change for #1225
2023-08-21 10:01:10 +02:00
the-djmaze
197f597d1c
Resolve #1134
2023-05-23 13:53:44 +02:00
the-djmaze
59aa1cac35
Resolve #1125
2023-05-12 23:43:13 +02:00
the-djmaze
c7cc250b1e
Resolve #1086
2023-04-18 09:31:14 +02:00
the-djmaze
8630b418d1
Resolve #1082
2023-04-18 09:22:04 +02:00
the-djmaze
8c7fd77762
Resolve #1001
2023-03-06 11:55:32 +01:00
the-djmaze
d92f25973b
fix unicode email address matching #955
2023-02-23 17:38:41 +01:00
the-djmaze
5ef79e5148
Also match unicode email addresses #955
2023-02-23 17:24:23 +01:00
the-djmaze
d10aec8f08
Resolve #955 and allow unicode
2023-02-22 08:51:33 +01:00
the-djmaze
8a8d1d756e
centralize elementById('rl-app')
2023-02-20 15:47:46 +01:00
the-djmaze
e56d1cf5c6
Resolve #954
2023-02-20 11:50:11 +01:00
the-djmaze
3e99f760a4
Resolve #953
2023-02-20 11:25:20 +01:00
the-djmaze
75a6353445
Remove CSS white-space from messages to prevent annoying side scrolling
2023-02-17 13:35:59 +01:00
the-djmaze
3b7deb1328
Improved cleanHtml() and cleanCSS() handling
2023-02-17 08:54:17 +01:00
the-djmaze
a9eff27f99
Resolve #972
2023-02-16 16:08:05 +01:00
the-djmaze
ae1e6184c3
Resolve #956
2023-02-15 11:57:30 +01:00
the-djmaze
7a762e50c7
Resolve #957
2023-02-15 11:57:01 +01:00
the-djmaze
8058c8d2f6
Allow <body> element CSS as .mail-body
2023-02-15 11:26:21 +01:00
the-djmaze
bd9e50f222
Bugfix: new CSS <style> removing (background-)?color failed
2023-02-14 16:51:51 +01:00
the-djmaze
5105f6d4c1
Improved handling of secure message <style> CSS class names
2023-02-14 15:21:43 +01:00
the-djmaze
64818025e8
Added feature to allow <style> in messages
2023-02-14 14:54:38 +01:00
the-djmaze
415102aa37
Replace Element.fromHTML() with createElement()
2023-02-11 20:38:57 +01:00
the-djmaze
7aa5142047
Speedup cleanHtml() parser
2023-02-07 08:56:51 +01:00
the-djmaze
a1441c9f22
Removed disabled blockquote height calculator for #902
2023-02-07 08:51:02 +01:00
