mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 08:13:50 +00:00
The conversation view used on phones built its own sanitizer hook that only caught `<img src>` starting with a lowercase scheme and inline style `url()`, and its iframe CSP always allowed http(s) images. With remote content blocked (the default `ask` policy) uppercase schemes, srcset, `<source>`, video posters and background attributes still loaded, so trackers fired when a phone user opened a thread. The view now uses the desktop viewer's `blockExternalResourcesOnNode`, and the strict iframe CSP is shared as `emailIframeCsp()` and applied whenever remote content is blocked, together with `no-referrer`.