mirror of
https://github.com/root-fr/jmap-webmail.git
synced 2026-09-23 08:01:14 +00:00
Matthieu MALVACHE
cc01b84f46
The plain-text email renderer escaped <, >, and & before building anchor tags for linkified URLs, but did not escape " or '. A crafted URL containing a quote broke out of the href attribute and could inject event handlers into the rendered HTML. Affects both the single-email viewer and the threaded conversation view. Fix by extracting a shared plainTextToSafeHtml helper that escapes all five HTML-significant characters in the correct order before linkification. Both views route through it. Regression tests parse the output and assert no event handler lands on the anchor element. Reported privately by Linus Rath. Thank you for the responsible disclosure. Also bumps dependencies flagged by npm audit: - Next.js 16.1.5 -> 16.2.4 (DoS in Server Components) - next-intl 4.5.8 -> 4.9.1 (open redirect) - DOMPurify 3.3.1 -> 3.4.0 (FORBID_TAGS bypass) - picomatch, vite, brace-expansion resolve transitively Also carries the Apache JAMES compose fix from the 1.4.0 cycle (explicit text/plain type on textBody per RFC 8621 section 4.1.4) and the missing email_viewer.send translation. Release 1.4.1.