mirror of
https://github.com/root-fr/jmap-webmail.git
synced 2026-09-24 08:01:19 +00:00
Matthieu MALVACHE
d33309a8b6
Plain-text email bodies were escaped for <, >, & but not " or ', and the URL linkifier regex captured every non-whitespace character up to the next <. A URL containing a double or single quote broke out of the href attribute in the rendered anchor, allowing arbitrary event handlers to be injected into otherwise plain-text mail. Reported by @rathlinus. Extract a shared plainTextToSafeHtml helper in lib/email-sanitization.ts that escapes all five HTML-significant characters in the correct order before linkification, and route both email-viewer and thread view through it. Add tests that parse the output and assert no onmouseover attribute lands on the anchor element. Also bump dependencies flagged by npm audit: next 16.2.4 (DoS in Server Components), next-intl 4.9.1 (open redirect), dompurify 3.4.0 (FORBID_TAGS bypass); picomatch/vite/brace-expansion resolve transitively. npm audit is clean. Bump version to 1.4.1.