djmaze 49dd9a7c7c @ZaphodB fix(security): attachments rendered inline as the type their sender declared ... Raw view served an attachment inline with the Content-Type from the message, only forcing PDF by file name. A part named photo.png declared as text/html is previewed as an image by extension, and its link opened an HTML page on the webmail origin. The raw CSP (script-src 'none'; child-src 'none') stopped scripts, but replaced the global policy, so forms, meta refresh, base and remote styles and images all worked: a convincing phishing page under the real hostname. - inlineContentType() allows only raster images, PDF, audio, video and text/plain to be shown as declared. Other text/* is shown as text/plain (an HTML attachment displays its source); anything else, SVG and XML included, is sent as an application/octet-stream download. - The raw CSP adds default-src 'none', form-action 'none' and base-uri 'none', with explicit img, media, style and object sources for what raw view legitimately shows. object-src 'self' keeps the browser PDF viewer usable (not verified in a browser here). test/raw-inline-type.php covers the type decision, parameters and case.		2026-10-26 00:29:19 +01:00
..
carddav.php	Test CardDAV for #79	2021-04-15 12:41:01 +02:00
crypt-forgery.php	@ZaphodB fix(security): tokens could be forged by choosing the xxtea algorithm	2026-10-25 23:36:57 +01:00
header-injection.php	@ZaphodB fix(security): strip line breaks from decoded and outgoing header values	2026-10-24 11:50:10 +02:00
raw-inline-type.php	@ZaphodB fix(security): attachments rendered inline as the type their sender declared	2026-10-26 00:29:19 +01:00
sasl.php	Resolve #695	2022-11-23 16:26:26 +01:00
smime-verify.php	@ZaphodB fix(security): S/MIME verify reported altered messages as validly signed	2026-10-24 11:57:38 +02:00
sso.php	Use SNAPPYMAIL_INCLUDE_AS_API and added SSO test	2022-01-10 16:10:56 +01:00