Linus Rath 6ff94d439e fix: pin Lite pages to their own inline scripts and guard the Stalwart bundle ...

The static export's header policy has to allow inline scripts (the
hydration scripts differ per page and one header cannot list them all),
so any injected inline script ran. The Stalwart bundle had no policy at
all: Stalwart sends no security headers for an Application, and nothing
stopped another site from framing it.

- Postbuild gives every page of the static target a `<meta>` CSP that
  allows exactly the page's own inline scripts; enforced together with
  the host's header, it takes away `'unsafe-inline'`. `verify` fails a
  page whose inline scripts are not all pinned.
- The Stalwart entry document carries a `<meta>` CSP (no plugins, eval,
  foreign scripts or moved `<base>`; its shells are rewritten at runtime,
  so hashes are not possible there) and refuses to run inside a frame
  of another origin.
- The nginx and Caddy examples send the same CSP as `_headers`.

2026-09-26 17:27:00 +02:00

..

__tests__

fix: pin Lite pages to their own inline scripts and guard the Stalwart bundle

2026-09-26 17:27:00 +02:00

admin

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

auth

fix: revoke Lite refresh tokens on sign-out and keep no failed-login password

2026-09-26 17:15:55 +02:00

connector

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

demo

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

global-search

fix: send mail search terms as typed instead of with a fake prefix wildcard

2026-09-22 21:04:18 +02:00

impersonation

fix: refuse a used impersonation link after a restart or on another replica

2026-09-26 16:34:58 +02:00

jmap

fix: keep a reply draft in its thread when it is re-opened or undone

2026-09-26 16:06:28 +02:00

oauth

fix: never follow redirects on OAuth token and revocation requests

2026-09-26 15:13:41 +02:00

plugin-sandbox

fix: keep plugin storage per account and delete it on sign-out

2026-09-26 16:47:29 +02:00

protocol-handlers

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

security

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

setup

fix: keep the setup token out of access logs, referers and history

2026-09-26 16:32:38 +02:00

sieve

fix: stop filter rule data from breaking out into the Sieve script

2026-09-26 14:56:01 +02:00

stalwart

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

telemetry

fix: check telemetry targets at connect time and fail closed

2026-09-26 15:15:23 +02:00

version-check

fix: invalidate persisted update status after an upgrade

2026-08-29 12:46:39 +02:00

webdav

fix: pin supported-calendar-component-set on created calendars #760

2026-08-25 19:16:20 +02:00

wopi

fix: end office editor sessions when the user signs out

2026-09-26 16:40:46 +02:00

account-state-manager.ts

fix: reset the account security page when switching accounts

2026-09-26 15:34:13 +02:00

account-utils.ts

fix: detect HTTP/2 from the initial navigation timing so accounts aren't capped at five

2026-09-10 10:14:25 +02:00

attachment-visibility.ts

fix: hide body-embedded cid parts declared as octet-stream from the attachment list

2026-09-10 10:45:45 +02:00

birthday-calendar.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

browser-navigation.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

builtin-themes.ts

feat: add "Flat fields" theme

2026-09-19 13:01:07 +02:00

calendar-alerts.ts

fix: strike through cancelled events and mute their reminders #572

2026-07-07 23:26:36 +02:00

calendar-component-detection.ts

fix(calendar): hide tasks-only calendars from the event calendar UI

2026-08-16 21:18:57 +02:00

calendar-editability.ts

fix: rsvp controls

2026-09-03 22:12:15 -07:00

calendar-event-normalization.ts

feat: use Stalwart synthetic ids for recurring occurrences #140

2026-08-29 11:03:48 +02:00

calendar-ics-export.ts

i18n: add missing translation keys

2026-04-21 17:42:52 +02:00

calendar-invitation.ts

fix: export isCalendarMimeType for use in email attachment filtering

2026-04-16 16:54:09 +02:00

calendar-participants.ts

fix(calendar): dedupe participants, resolve contact names, show organizer status

2026-09-07 16:48:26 +08:00

calendar-scroll-window.ts

feat: setting to turn off free scrolling in the calendar

2026-09-09 18:27:01 +02:00

calendar-utils.ts

feat: freely scrolling month, week and day views #759

2026-09-09 16:38:55 +02:00

clear-cached-data.ts

fix: route multi-account email lookups and invitation parsing by source account #847

2026-08-25 18:50:50 +02:00

color-transform.ts

feat: add participant scheduling with iTIP invitations and inline calendar invitation banner

2026-02-17 01:09:57 +01:00

debug.ts

feat: store trusted senders in a dedicated JMAP address book #176

2026-04-12 01:10:28 +02:00

deep-link-handoff.ts

feat: open global search hits through the owning login on every surface #847

2026-09-01 20:55:13 +02:00

deep-links.ts

fix: open a push notification's message in the account it came from

2026-09-26 16:12:20 +02:00

download-filename.ts

fix: never loop forever when deduping drag-out .eml names #1039

2026-09-17 21:42:16 +02:00

email-action-toast.ts

feat: add missing mail action toasts and show sonner toasts again

2026-09-21 20:52:02 +02:00

email-body-selection.ts

fix: render plain-text-only mail as text in the mobile thread view #489

2026-08-31 20:41:45 +02:00

email-composer-utils.ts

fix: stop a quoted sender name from adding a recipient to a draft

2026-09-26 15:48:27 +02:00

email-date.ts

fix: parse calendar invitations in directly viewed shared folders against the folder owner #867

2026-08-25 19:36:04 +02:00

email-fit-width.ts

fix: wrap text in fixed-width tables to the screen on iOS #1020

2026-09-23 19:41:44 +02:00

email-headers.ts

fix: stop a sender from faking a DMARC or DKIM pass in the security badges

2026-09-26 14:13:33 +02:00

email-sanitization.ts

fix: close remote-content gaps in the print view and the external-URL checks

2026-09-26 15:11:46 +02:00

email-source.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

email-threading.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

eml-import.ts

feat: support importing emails from .zip archives

2026-05-22 15:22:33 +02:00

favicon-badge.ts

feat: redesign the unread favicon badge as a compact keyline badge

2026-08-20 16:49:31 +02:00

file-name-rules.ts

fix: handle the file names and types Stalwart refuses

2026-09-22 20:54:01 +02:00

file-preview.ts

fix: keep an SVG attachment thumbnail from running script in the webmail origin

2026-09-26 14:30:19 +02:00

folder-tree-dnd.ts

fix: folder drag & drop can move folders into other parents #855

2026-08-20 14:21:41 +02:00

forward-as-attachment.ts

fix: strip from/to names from forward-as-attachment filenames

2026-07-29 11:41:34 +12:00

html-to-text.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

idn.ts

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

iframe-bridge.ts

fix: pin parent origin in iframe-bridge to block cross-frame postMessage

2026-05-18 16:01:29 +02:00

jalali-utils.ts

feat: add Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)

2026-07-08 15:42:42 +02:00

keyboard.ts

fix: detect typing inside the QuotedHtml shadow island via composedPath #654

2026-07-21 23:26:51 +02:00

keyword-discovery.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

keyword-format.ts

feat: Add nesting of tags in a tree

2026-07-29 17:18:38 +02:00

keyword-nesting.ts

feat: allow hidden tags, either permanent or when there are no unread messages

2026-07-29 17:18:42 +02:00

list-attachments.ts

fix: load attachment chips lazily instead of in the message list #1089

2026-09-23 18:09:35 +02:00

lite-config.ts

feat: add OpenID Connect login to the Stalwart Lite bundle

2026-09-21 23:45:08 +02:00

lite-link-segments.ts

fix: harden Bulwark Lite login, deep-link replay and settings gating

2026-09-18 22:16:57 +02:00

lite-mounted-href.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

lite-static-params.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

lite.ts

feat: add Bulwark Lite build for Stalwart Applications

2026-09-19 00:53:53 +02:00

logger.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

mailbox-label.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mdn.ts

fix: strip CR/LF from read-receipt header values (GHSA-w38p-hpqv-g89c)

2026-09-17 20:55:39 +02:00

message-list-order.ts

fix: keep bringing up unread mail past the first page in unread-first order

2026-09-23 21:01:48 +02:00

notification-sound.ts

Fix: notification sound preview - base-path prefix + longer default beep

2026-07-04 14:52:26 +02:00

pending-notification-store.ts

feat: surface CalendarEventNotification invitations and updates

2026-08-29 18:11:50 +02:00

plugin-hooks.ts

feat: OAuth handler for plugins; extended contacts and addressbook API

2026-08-31 09:55:06 +02:00

plugin-loader.ts

Feature: localizable sandboxed plugins (manifest locales + api.i18n.t)

2026-05-30 15:56:55 +02:00

plugin-oauth.ts

feat: OAuth handler for plugins; extended contacts and addressbook API

2026-08-31 09:55:06 +02:00

plugin-projection.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

plugin-storage.ts

fix: clear the accounts' leftovers when everyone signs out

2026-09-26 16:55:34 +02:00

plugin-types.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

plugin-validator.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

push-relays.ts

feat: pick push relay from admin-defined list instead of a URL field

2026-08-16 23:04:22 +02:00

quote-collapse.ts

feat: collapse quoted reply text behind a "..." toggle #480

2026-07-22 19:17:23 +02:00

quote-header.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

read-file-env.ts

feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars

2026-04-09 22:13:08 +02:00

recurrence-expansion.ts

fix: keep daily recurring events going past a DST gap

2026-09-26 15:45:59 +02:00

recurrence-instances.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-overrides.ts

fix: keep single-occurrence edits on that occurrence and keep its details

2026-09-23 13:40:01 +02:00

recurrence-rule.ts

fix(calendar): drop default SKIP=OMIT from recurrence rules (DAVx5 sync)

2026-08-25 21:13:34 +02:00

reply-identity.ts

feat: choose exact-address or same-domain matching for reply from received address #1000

2026-09-09 19:27:08 +02:00

reply-recipients.ts

fix(reply): honour an external Reply-To even on a self-sent message

2026-08-16 21:12:21 +02:00

rfc5322-mailbox.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

search-scope-folders.ts

fix: include shared accounts in "All folders" mail search #1082

2026-09-22 17:25:43 +02:00

search-snippet.ts

feat: highlight search hits with SearchSnippet/get

2026-08-29 17:47:23 +02:00

search-suggestions.ts

feat: search suggestions with recent searches and contact autocomplete #845

2026-08-25 20:09:18 +02:00

server-auth-status.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

settings-search.ts

fix: translate the themes settings panel

2026-09-26 12:54:30 +02:00

settings-sync.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

shared-calendar-colors.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

sidebar-apps.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

sign-out-cleanup.ts

fix: clear the accounts' leftovers when everyone signs out

2026-09-26 16:55:34 +02:00

signature-utils.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

store-epoch.ts

fix: drop folder and filter fetches that finish after an account switch

2026-09-26 15:31:05 +02:00

sub-addressing.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

subject-prefix.ts

fix: keep the fresh-compose tab title clear of the selected email subject

2026-08-18 15:48:05 +02:00

template-types.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

template-utils.ts

fix: keep already written text when applying a template in compose #540

2026-08-16 22:20:49 +02:00

theme-color-meta.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

theme-compiler.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

theme-flat-fields.ts

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

theme-loader.ts

fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors

2026-09-26 14:36:02 +02:00

thread-routing.ts

fix: open right conversations in shared mailbox #814

2026-08-16 02:19:04 +02:00

thread-utils.ts

fix: scope thread identity to the owning account in unified views #1012

2026-09-18 18:33:02 +02:00

timezone.ts

fix: query calendar ranges in the right time zone and past the limits

2026-09-22 20:42:07 +02:00

tnef.ts

fix: stop a crafted winmail.dat from freezing the tab

2026-09-26 14:15:10 +02:00

unified-mailbox.ts

fix: page each account of a merged list from its own position

2026-09-26 15:43:32 +02:00

upload-progress.ts

feat: real byte progress for attachment uploads, stock and plugin-offloaded

2026-08-23 19:44:56 +06:00

utils.ts

fix: keep the inbox rendering when a message has an unparsable date #1099

2026-09-24 17:47:33 +02:00

validation.ts

fix: show what a mailto unsubscribe sends and limit it to one recipient

2026-09-26 14:41:14 +02:00

vcard.ts

fix: set name.full on all contact write paths so vCards carry mandatory FN #430

2026-08-31 23:53:24 +02:00

version-compare.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

web-push.ts

fix: keep inbox-only push working for accounts shared without an inbox #983

2026-09-23 05:56:28 +02:00