Files
webmail/components/email
Linus Rath 928633d087 fix: close remote-content gaps in the print view and the external-URL checks
Printing a message opened an about:blank popup that carries the app's
CSP (`img-src https:`), not the message iframe's strict one, so with
remote content blocked anything the DOM walk missed still loaded when
printing. The print document now carries the iframe CSP and
`no-referrer`.

The DOM walk itself missed several spellings the browser still loads:

- backslashes, which the URL parser reads as slashes (`/\host`,
  `https:\host`), and `https:host` without slashes
- an escaped `url` keyword in a style attribute (`\75 rl(`)
- `image-set()` with plain strings
- an unclosed `url(` at the end of a style attribute
2026-09-26 15:11:46 +02:00
..