starred/webmail
1
0
Fork 0
mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-31 16:13:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,214 Commits 5 Branches 63 Tags
2ed87b2b7fabc19644a492fee76f19df6fa40737
Commit Graph
12 Commits
Author SHA1 Message Date
Linus Rath 08969fde67 fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes 2026-10-26 14:52:04 +01:00
Linus Rath 9f3441c783 fix: accept both fetch response types in the capped feed reader 2026-10-19 01:36:16 +02:00
Linus Rath 5632097971 fix: type the capped feed reader and the invitation sender lookup 2026-10-19 01:32:23 +02:00
Linus Rath c0b6519136 fix: stop reading a calendar feed at the size cap instead of buffering it whole 2026-10-19 01:15:04 +02:00
Linus Rath 9b9b4f7ef1 fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g) 
The origin gate in the proxy only covered `/api/auth/*`. The JMAP
passthrough, `/api/settings`, `/api/wopi/launch`,
`/api/plugin-approval-status`, `/api/fetch-ical`, `/api/translate`,
`/api/caldav/discover`, `/api/calendar-agenda` and `/api/webdav` all act
with the session cookie and had no origin check. A page on a same-site
sibling origin receives SameSite=Lax cookies, so it could run arbitrary
JMAP as the signed-in user, including sharing mailboxes to a third
account.

The proxy now gates every `/api/` route except the WOPI file endpoints
the office editor calls server-to-server, and each of these handlers
checks again. The proxy also decides on the decoded path, so an escaped
spelling such as `/api/%61uth/session` no longer skips the gate.
 2026-09-26 14:08:44 +02:00
Linus Rath 07bbde4786 fix: make the iCal subscription size limit configurable and show the real error #692 2026-09-07 22:34:47 +02:00
Linus Rath 3288589e52 fix: pin resolved IP at connect time to block DNS-rebinding SSRF (GHSA-24w9-8r42-8jwm) 2026-08-26 22:11:06 +02:00
Linus Rath 32fe871b70 fix: support HTTP basic auth in iCal subscription URLs #275 2026-05-13 14:27:54 +02:00
Linus Rath 3043639d2d fix: validate URLs before outbound fetch 2026-04-27 22:23:39 +02:00
Linus Rath aa40c8be26 fix: harden proxy auth and SSRF defenses 2026-03-31 17:47:09 +02:00
Linus Rath a3d894730b fix: hardened security, CSP enforcement, SSRF redirect validation, reenabled S/MIME chain verify, IP spoofing prevention, PDF iframe sandbox 2026-03-31 15:11:38 +02:00
Linus Rath caed067cda feat: implement calendar management features including create, update, and delete functionalities 2026-03-15 00:14:58 +01:00