mirror of
https://github.com/the-djmaze/snappymail.git
synced 2026-11-03 19:08:50 +03:00
08f34b9954
The sanitizer sends img src, and url() in background-image, list-style-image and content, through the remote content handling: blocked until the user allows it, rewritten to the proxy when it is on. Two other ways to load an image were left alone: - srcset (and sizes) were on the attribute allowlist and never rewritten, so <img srcset="https://..."> loaded when the message opened. With the proxy on, the CSP keeps img-src to 'self', but a relative srcset="?/ProxyExternal/<b64>" is same-origin and made the server fetch an attacker URL at render time: a read receipt with no click. With the proxy off the browser fetched directly. - url() in any other style property (border-image-source, mask-image, filter, ...) kept its value, with the same two outcomes. Drop srcset and sizes from the allowlist (attributes not on it are deleted), and remove any other style property whose value holds url(). Relative img src was already safe: anything not cid:, http(s) or data:image/ is parked as data-x-src-broken. Checked the style sweep in Chromium: border-image-source, mask-image (both spellings), filter and cursor lose the url(), other declarations survive, and the background/list-style shorthands are left to the existing handling. |
||
|---|---|---|
| .. | ||
| App | ||
| Common | ||
| Component | ||
| DAV | ||
| External | ||
| Knoin | ||
| Mime | ||
| Model | ||
| Remote | ||
| Screen | ||
| Settings | ||
| Sieve | ||
| Storage | ||
| Stores | ||
| Styles | ||
| View | ||
| admin.js | ||
| app.js | ||
| boot.js | ||
| bootstrap.js | ||
| dragdropgecko.js | ||
| prototype.js | ||
| serviceworker.js | ||
| shortcuts.js | ||
| sieve.js | ||