mirror of
https://github.com/bulwarkmail/native.git
synced 2026-10-31 08:06:36 +00:00
Linus Rath
a27d014c59
Any web page (one tap) or installed app (no tap) could fire a `bulwarkmail://pair` link at the app, which then silently added the sender's mailbox and switched to it, so the user might send or save mail into an attacker's account. A `connect` link likewise opened any server's sign-in page. - Links that arrive from outside the app now ask first, naming the webmail's host and whether the link adds an account. Cancel discards the link for good; a link delivered again while the question is open is dropped. Codes scanned or pasted inside the app still go straight through. - With the account registry full, a link shows the limit instead of opening "Add account". - A pairing link for a plain-http webmail says the connection would be unencrypted instead of "That code isn't a Bulwark sign-in code", or nothing at all for a tapped link.