2 Commits

Include renames

Author	SHA1	Message	Date
Matthieu MALVACHEandClaude Sonnet 4.5	395f92c47f	feat(email): add newsletter unsubscribe and enhance dark mode ... Implement RFC 2369 List-Unsubscribe support with security validation (protocol whitelist, XSS prevention), two-step confirmation UI, and localStorage persistence. Add intelligent color transformation for dark mode to fix unreadable inline email styles using WCAG 2.0 luminance calculation. Complete batch spam undo operations for context menu multi-select. Update documentation with new features and comprehensive test coverage (97 tests). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>	2026-01-08 18:39:27 +01:00
Matthieu MALVACHE	d301dd15ff	security: fix XSS vulnerabilities in identity management ... - Add unified email sanitization utility (lib/email-sanitization.ts) - Safe HTML parsing using DOMParser instead of innerHTML - Consistent DOMPurify configuration across components - Separate signature sanitization with stricter rules - Add secure email validation (lib/validation.ts) - RFC 5322 compliant validation - Block header injection attempts (\r\n<>) - Validate comma-separated email lists - Fix HTML signature XSS (identity-form.tsx) - Sanitize signatures before storage and rendering - Add live preview with safe rendering - Input length limits for defense in depth - Fix innerHTML XSS (email-viewer.tsx, thread-conversation-view.tsx) - Replace unsafe innerHTML with DOMParser for format detection - Use shared EMAIL_SANITIZE_CONFIG - Add <meta>, <link>, <base> to forbidden tags Security issues resolved: - H1: Stored XSS in HTML signatures (CVSS 7.1) - H2: XSS during HTML parsing (CVSS 6.8) - M1: Email validation bypass (CVSS 4.3) - M3: Inconsistent sanitization (CVSS 5.0) Zero new dependencies. All tests passing.	2026-01-08 16:12:53 +01:00