Linus Rath 809db3b38d fix: block remote content in the mobile conversation view ...

The conversation view used on phones built its own sanitizer hook that
only caught `<img src>` starting with a lowercase scheme and inline
style `url()`, and its iframe CSP always allowed http(s) images. With
remote content blocked (the default `ask` policy) uppercase schemes,
srcset, `<source>`, video posters and background attributes still
loaded, so trackers fired when a phone user opened a thread.

The view now uses the desktop viewer's `blockExternalResourcesOnNode`,
and the strict iframe CSP is shared as `emailIframeCsp()` and applied
whenever remote content is blocked, together with `no-referrer`.

2026-09-26 14:45:20 +02:00

..

__tests__

fix: block remote content in the mobile conversation view

2026-09-26 14:45:20 +02:00

attachment-chips.tsx

fix: load attachment chips lazily instead of in the message list #1089

2026-09-23 18:09:35 +02:00

calendar-invitation-banner.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

compose-format.ts

feat: add per-message HTML/plain-text toggle #1022

2026-09-17 22:34:20 +02:00

email-composer.tsx

fix: reply from the receiving account's identity in the unified inbox #1104

2026-09-26 12:31:29 +02:00

email-context-menu.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

email-hover-actions.tsx

Merge pull request #1032 from douwezijlstra-frl/fix/hover-tag-quick-action

2026-09-23 19:16:55 +02:00

email-identity-badge.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

email-list.tsx

fix: load attachment chips lazily instead of in the message list #1089

2026-09-23 18:09:35 +02:00

email-viewer.tsx

fix: block remote content in the mobile conversation view

2026-09-26 14:45:20 +02:00

font-size.ts

feat(composer): sticky formatting toolbar and font-size picker

2026-09-07 16:58:50 +08:00

message-list-tabs.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

quoted-html.ts

fix(email): show quote bar in email replies

2026-07-16 17:56:38 +02:00

read-receipt-banner.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

recipient-popover.tsx

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

resizable-image.tsx

fix: preserve inline images when replying #163

2026-05-22 12:06:55 +02:00

rich-text-editor.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

search-snippet-text.tsx

feat: highlight search hits with SearchSnippet/get

2026-08-29 17:47:23 +02:00

selectable-avatar.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

signature-block.ts

fix: address the review notes on the signature unlock

2026-08-19 11:56:18 +02:00

styled-block-attributes.ts

fix: let a double-click unlock the embedded signature for editing

2026-08-18 17:31:47 +02:00

tag-badge.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

tag-picker.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

text-direction.ts

feat(composer): auto-detect paragraph text direction by default

2026-07-16 17:56:50 +02:00

thread-conversation-view.tsx

fix: block remote content in the mobile conversation view

2026-09-26 14:45:20 +02:00

thread-email-item.tsx

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

thread-list-item.tsx

fix: sign in and show addresses on internationalized domains #1100

2026-09-24 21:15:22 +02:00

unsubscribe-banner.tsx

fix: show what a mailto unsubscribe sends and limit it to one recipient

2026-09-26 14:41:14 +02:00