Linus Rath 6f1cad1c98 fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors ...

The theme sanitizer was a short denylist. It missed protocol-relative
`url(//host)`, schemes and keywords spelled with CSS escapes
(`url(\68ttps:...)`, `@\69mport`), `image-set("https://...")` and
`@font-face` sources, so a theme could load remote resources from the
app document. `validateThemeSelectors` was never called, so theme CSS
could also target `input[type=password]` or restyle real UI. The admin
routes and the zip validator only sanitized when the safety check
failed, and CSS returned by the `onThemeBeforeApply` plugin hook was
injected as-is.

- every `url()` except a `#fragment` and every `image-set()` is removed
  with its arguments; a banned construct spelled with escapes drops the
  whole stylesheet
- theme CSS keeps only `:root` and `.dark` rules (no nested rules),
  plus `@font-face`, `@keyframes` and `@media`/`@supports` wrappers
- sanitizing is unconditional everywhere, including plugin-transformed
  CSS; compiled token values may not contain escapes or `url()`

2026-09-26 14:36:02 +02:00

..

__tests__

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

admin

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

auth

fix: keep the Stalwart master password out of impersonated sessions

2026-09-26 14:05:05 +02:00

connector

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

demo

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

global-search

fix: send mail search terms as typed instead of with a fake prefix wildcard

2026-09-22 21:04:18 +02:00

impersonation

fix: keep the Stalwart master password out of impersonated sessions

2026-09-26 14:05:05 +02:00

jmap

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

oauth

fix: leave out the id token when sign-in cookies would overflow nginx's header buffer #1096

2026-09-24 18:23:11 +02:00

plugin-sandbox

fix: require manifest permissions for plugin hooks and slots

2026-09-26 14:26:33 +02:00

protocol-handlers

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

security

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

setup

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

sieve

fix: stop folder rules from pulling spam out of Junk

2026-09-22 20:14:42 +02:00

stalwart

fix: let non-admin users see their name and change a TOTP password

2026-09-22 20:28:01 +02:00

telemetry

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

version-check

fix: invalidate persisted update status after an upgrade

2026-08-29 12:46:39 +02:00

webdav

fix: pin supported-calendar-component-set on created calendars #760

2026-08-25 19:16:20 +02:00

wopi

fix: stop office attachment launch hanging while checking the blob #1047

2026-09-23 19:03:37 +02:00

account-state-manager.ts

fix(files): reset the account-scoped Files drive on every account switch

2026-08-13 23:01:41 +02:00

account-utils.ts

fix: detect HTTP/2 from the initial navigation timing so accounts aren't capped at five

2026-09-10 10:14:25 +02:00

attachment-visibility.ts

fix: hide body-embedded cid parts declared as octet-stream from the attachment list

2026-09-10 10:45:45 +02:00

birthday-calendar.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

browser-navigation.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

builtin-themes.ts

feat: add "Flat fields" theme

2026-09-19 13:01:07 +02:00

calendar-alerts.ts

fix: strike through cancelled events and mute their reminders #572

2026-07-07 23:26:36 +02:00

calendar-component-detection.ts

fix(calendar): hide tasks-only calendars from the event calendar UI

2026-08-16 21:18:57 +02:00

calendar-editability.ts

fix: rsvp controls

2026-09-03 22:12:15 -07:00

calendar-event-normalization.ts

feat: use Stalwart synthetic ids for recurring occurrences #140

2026-08-29 11:03:48 +02:00

calendar-ics-export.ts

i18n: add missing translation keys

2026-04-21 17:42:52 +02:00

calendar-invitation.ts

fix: export isCalendarMimeType for use in email attachment filtering

2026-04-16 16:54:09 +02:00

calendar-participants.ts

fix(calendar): dedupe participants, resolve contact names, show organizer status

2026-09-07 16:48:26 +08:00

calendar-scroll-window.ts

feat: setting to turn off free scrolling in the calendar

2026-09-09 18:27:01 +02:00

calendar-utils.ts

feat: freely scrolling month, week and day views #759

2026-09-09 16:38:55 +02:00

clear-cached-data.ts

fix: route multi-account email lookups and invitation parsing by source account #847

2026-08-25 18:50:50 +02:00

color-transform.ts

feat: add participant scheduling with iTIP invitations and inline calendar invitation banner

2026-02-17 01:09:57 +01:00

debug.ts

feat: store trusted senders in a dedicated JMAP address book #176

2026-04-12 01:10:28 +02:00

deep-link-handoff.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

deep-links.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

download-filename.ts

fix: never loop forever when deduping drag-out .eml names #1039

2026-09-17 21:42:16 +02:00

email-action-toast.ts

feat: add missing mail action toasts and show sonner toasts again

2026-09-21 20:52:02 +02:00

email-body-selection.ts

fix: render plain-text-only mail as text in the mobile thread view #489

2026-08-31 20:41:45 +02:00

email-composer-utils.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

email-date.ts

fix: parse calendar invitations in directly viewed shared folders against the folder owner #867

2026-08-25 19:36:04 +02:00

email-fit-width.ts

fix: wrap text in fixed-width tables to the screen on iOS #1020

2026-09-23 19:41:44 +02:00

email-headers.ts

fix: stop a sender from faking a DMARC or DKIM pass in the security badges

2026-09-26 14:13:33 +02:00

email-sanitization.ts

fix: keep security headers on dotted app paths and neutralise cid: blobs (GHSA-xvjh-v9c6-qcvc)

2026-09-17 21:08:37 +02:00

email-source.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

email-threading.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

eml-import.ts

feat: support importing emails from .zip archives

2026-05-22 15:22:33 +02:00

favicon-badge.ts

feat: redesign the unread favicon badge as a compact keyline badge

2026-08-20 16:49:31 +02:00

file-name-rules.ts

fix: handle the file names and types Stalwart refuses

2026-09-22 20:54:01 +02:00

file-preview.ts

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

folder-tree-dnd.ts

fix: folder drag & drop can move folders into other parents #855

2026-08-20 14:21:41 +02:00

forward-as-attachment.ts

fix: strip from/to names from forward-as-attachment filenames

2026-07-29 11:41:34 +12:00

html-to-text.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

idn.ts

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

iframe-bridge.ts

fix: pin parent origin in iframe-bridge to block cross-frame postMessage

2026-05-18 16:01:29 +02:00

jalali-utils.ts

feat: add Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)

2026-07-08 15:42:42 +02:00

keyboard.ts

fix: detect typing inside the QuotedHtml shadow island via composedPath #654

2026-07-21 23:26:51 +02:00

keyword-discovery.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

keyword-format.ts

feat: Add nesting of tags in a tree

2026-07-29 17:18:38 +02:00

keyword-nesting.ts

feat: allow hidden tags, either permanent or when there are no unread messages

2026-07-29 17:18:42 +02:00

list-attachments.ts

fix: load attachment chips lazily instead of in the message list #1089

2026-09-23 18:09:35 +02:00

lite-config.ts

feat: add OpenID Connect login to the Stalwart Lite bundle

2026-09-21 23:45:08 +02:00

lite-link-segments.ts

fix: harden Bulwark Lite login, deep-link replay and settings gating

2026-09-18 22:16:57 +02:00

lite-mounted-href.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

lite-static-params.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

lite.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

logger.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

mailbox-label.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mdn.ts

fix: strip CR/LF from read-receipt header values (GHSA-w38p-hpqv-g89c)

2026-09-17 20:55:39 +02:00

message-list-order.ts

fix: keep bringing up unread mail past the first page in unread-first order

2026-09-23 21:01:48 +02:00

notification-sound.ts

Fix: notification sound preview - base-path prefix + longer default beep

2026-07-04 14:52:26 +02:00

pending-notification-store.ts

feat: surface CalendarEventNotification invitations and updates

2026-08-29 18:11:50 +02:00

plugin-hooks.ts

feat: OAuth handler for plugins; extended contacts and addressbook API

2026-08-31 09:55:06 +02:00

plugin-loader.ts

Feature: localizable sandboxed plugins (manifest locales + api.i18n.t)

2026-05-30 15:56:55 +02:00

plugin-oauth.ts

feat: OAuth handler for plugins; extended contacts and addressbook API

2026-08-31 09:55:06 +02:00

plugin-projection.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

plugin-storage.ts

fix: fail fast when the plugin storage database is blocked #840

2026-09-07 22:34:47 +02:00

plugin-types.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

plugin-validator.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

push-relays.ts

feat: pick push relay from admin-defined list instead of a URL field

2026-08-16 23:04:22 +02:00

quote-collapse.ts

feat: collapse quoted reply text behind a "..." toggle #480

2026-07-22 19:17:23 +02:00

quote-header.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

read-file-env.ts

feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars

2026-04-09 22:13:08 +02:00

recurrence-expansion.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-instances.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-overrides.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-rule.ts

fix(calendar): drop default SKIP=OMIT from recurrence rules (DAVx5 sync)

2026-08-25 21:13:34 +02:00

reply-identity.ts

feat: choose exact-address or same-domain matching for reply from received address #1000

2026-09-09 19:27:08 +02:00

reply-recipients.ts

fix(reply): honour an external Reply-To even on a self-sent message

2026-08-16 21:12:21 +02:00

rfc5322-mailbox.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

search-scope-folders.ts

fix: include shared accounts in "All folders" mail search #1082

2026-09-22 17:25:43 +02:00

search-snippet.ts

feat: highlight search hits with SearchSnippet/get

2026-08-29 17:47:23 +02:00

search-suggestions.ts

feat: search suggestions with recent searches and contact autocomplete #845

2026-08-25 20:09:18 +02:00

server-auth-status.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

settings-search.ts

fix: translate the themes settings panel

2026-09-26 12:54:30 +02:00

settings-sync.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

shared-calendar-colors.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

sidebar-apps.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

signature-utils.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

sub-addressing.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

subject-prefix.ts

fix: keep the fresh-compose tab title clear of the selected email subject

2026-08-18 15:48:05 +02:00

template-types.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

template-utils.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

theme-color-meta.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

theme-compiler.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

theme-flat-fields.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

theme-loader.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

thread-routing.ts

fix: open right conversations in shared mailbox #814

2026-08-16 02:19:04 +02:00

thread-utils.ts

fix: scope thread identity to the owning account in unified views #1012

2026-09-18 18:33:02 +02:00

timezone.ts

fix: query calendar ranges in the right time zone and past the limits

2026-09-22 20:42:07 +02:00

tnef.ts

fix: stop a crafted winmail.dat from freezing the tab

2026-09-26 14:15:10 +02:00

unified-mailbox.ts

fix: a search inside a tag view narrows the tag instead of replacing it

2026-09-22 19:41:51 +02:00

upload-progress.ts

feat: real byte progress for attachment uploads, stock and plugin-offloaded

2026-08-23 19:44:56 +06:00

utils.ts

fix: keep the inbox rendering when a message has an unparsable date #1099

2026-09-24 17:47:33 +02:00

validation.ts

Fix: send mailto unsubscribe ourselves instead of via the OS handler

2026-07-08 15:41:46 +02:00

vcard.ts

fix: set name.full on all contact write paths so vCards carry mandatory FN #430

2026-08-31 23:53:24 +02:00

version-compare.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

web-push.ts

fix: keep inbox-only push working for accounts shared without an inbox #983

2026-09-23 05:56:28 +02:00