dealerweb b11c3e8932 fix: apply the data: URI allowlist to srcset candidates too ...

DOMPurify URI-tests srcset as a single string, so an allowed first
candidate waved every later one through - an SVG data: URI could ride
in behind a raster candidate on <img srcset> and <picture><source>.
Check every data: occurrence against the raster allowlist and drop the
whole attribute on one disallowed hit, including the external blocker's
data-blocked-srcset stash, which shares the hook pass with no ordering
guarantee. The token is captured through the metadata-ending comma so
the plain (non-base64) raster form keeps the same verdict as in src.

2026-08-12 17:47:51 +02:00

..

__tests__

fix: apply the data: URI allowlist to srcset candidates too

2026-08-12 17:47:51 +02:00

admin

Merge upstream/main to resolve conflicts

2026-07-22 02:54:55 +00:00

auth

feat: require re-authentication for device pairing and SSO

2026-06-05 19:23:06 +02:00

demo

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

impersonation

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

jmap

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

oauth

fix(oauth): harden OIDC discovery (timeout, retry, serve-stale)

2026-07-16 17:56:19 +02:00

plugin-sandbox

fix(plugins): make attachment offload workable and keep the write gate closed

2026-08-06 14:08:07 +02:00

protocol-handlers

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

security

fix: validate URLs before outbound fetch

2026-04-27 22:23:39 +02:00

setup

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

sieve

Feature: extended filter rules — attachment field + multi-value conditions

2026-05-30 15:45:33 +02:00

stalwart

fix: preserve POST across redirects in Stalwart JMAP passthrough #627

2026-07-16 22:51:07 +02:00

telemetry

feat: add option to disable calendar

2026-06-24 18:39:38 +02:00

version-check

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

webdav

fix: prefix remaining <img>, favicon, and WebDAV URLs with basePath #319

2026-05-25 16:45:13 +02:00

account-state-manager.ts

refactor: move S/MIME to generic crypto plugin hooks

2026-06-28 19:13:02 +02:00

account-utils.ts

feat(accounts): pin default account on top + drag-to-reorder switcher

2026-07-04 14:51:46 +02:00

birthday-calendar.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

browser-navigation.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

builtin-themes.ts

feat: add Aurora Glass built-in theme

2026-06-03 19:30:51 +02:00

calendar-alerts.ts

fix: strike through cancelled events and mute their reminders #572

2026-07-07 23:26:36 +02:00

calendar-event-normalization.ts

fix: JSCalendar 2.0 recurrenceRule single-object compatibility 116

2026-03-31 00:11:04 +02:00

calendar-ics-export.ts

i18n: add missing translation keys

2026-04-21 17:42:52 +02:00

calendar-invitation.ts

fix: export isCalendarMimeType for use in email attachment filtering

2026-04-16 16:54:09 +02:00

calendar-participants.ts

fix: stop re-adding the organizer to the attendee list on every save #731

2026-08-06 18:29:34 +02:00

calendar-utils.ts

fix: handle malformed event dates in calendar route #316

2026-05-22 14:04:02 +02:00

clear-cached-data.ts

feat(settings): add "Refresh cached data" recovery action

2026-07-21 20:58:55 +02:00

color-transform.ts

feat: add participant scheduling with iTIP invitations and inline calendar invitation banner

2026-02-17 01:09:57 +01:00

debug.ts

feat: store trusted senders in a dedicated JMAP address book #176

2026-04-12 01:10:28 +02:00

deep-link-handoff.ts

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

deep-links.ts

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

download-filename.ts

feat: add "Download all" button to bundle attachments into a zip #466

2026-06-24 18:46:41 +02:00

email-composer-utils.ts

fix: keep inline images when replying to octet-stream cid parts #543

2026-08-06 18:41:01 +02:00

email-headers.ts

fix: stop HELO spf=none from downgrading a MAIL FROM spf=pass #650

2026-07-21 23:03:34 +02:00

email-sanitization.ts

fix: apply the data: URI allowlist to srcset candidates too

2026-08-12 17:47:51 +02:00

email-source.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

email-threading.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

eml-import.ts

feat: support importing emails from .zip archives

2026-05-22 15:22:33 +02:00

error-reporting.ts

Initial release: JMAP Webmail Client

2025-12-10 17:54:22 +01:00

favicon-badge.ts

feat: show unread count badge on favicon

2026-07-16 18:00:41 +02:00

file-preview.ts

Feature: preview .eml (message/rfc822) attachments like an email

2026-06-01 17:25:14 +02:00

forward-as-attachment.ts

fix: strip from/to names from forward-as-attachment filenames

2026-07-29 11:41:34 +12:00

html-to-text.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

iframe-bridge.ts

fix: pin parent origin in iframe-bridge to block cross-frame postMessage

2026-05-18 16:01:29 +02:00

jalali-utils.ts

feat: add Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)

2026-07-08 15:42:42 +02:00

keyboard.ts

fix: detect typing inside the QuotedHtml shadow island via composedPath #654

2026-07-21 23:26:51 +02:00

keyword-discovery.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

keyword-format.ts

feat: Add nesting of tags in a tree

2026-07-29 17:18:38 +02:00

keyword-nesting.ts

feat: allow hidden tags, either permanent or when there are no unread messages

2026-07-29 17:18:42 +02:00

logger.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

mailbox-label.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mdn.ts

Feature: read receipts (MDN, RFC 8098)

2026-05-30 15:58:39 +02:00

notification-sound.ts

Fix: notification sound preview - base-path prefix + longer default beep

2026-07-04 14:52:26 +02:00

plugin-hooks.ts

fix(plugins): make attachment offload workable and keep the write gate closed

2026-08-06 14:08:07 +02:00

plugin-i18n.ts

fix: standardize punctuation

2026-04-16 19:07:42 +02:00

plugin-loader.ts

Feature: localizable sandboxed plugins (manifest locales + api.i18n.t)

2026-05-30 15:56:55 +02:00

plugin-projection.ts

feat: add plugin hooks for email details, headers, and source

2026-06-25 01:04:26 +02:00

plugin-storage.ts

feat: add 3 new plugin hooks : onBeforeBlobUpload, onBeforeDraftAutoSave, onBeforeEditDraft (#586)

2026-07-09 14:55:34 +02:00

plugin-types.ts

Merge pull request #685 from paulhenry46/contact-cryptokeys-slot

2026-08-07 01:43:16 +02:00

plugin-validator.ts

chore: update version to 1.5.3

2026-04-28 17:34:06 +02:00

quote-collapse.ts

feat: collapse quoted reply text behind a "..." toggle #480

2026-07-22 19:17:23 +02:00

quote-header.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

read-file-env.ts

feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars

2026-04-09 22:13:08 +02:00

recurrence-expansion.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

reply-identity.ts

fix(email): restore the sender identity when reopening a draft

2026-07-23 19:36:33 +02:00

reply-recipients.ts

fix: reply to own thread message addresses original recipients #703

2026-07-30 19:02:39 +02:00

rfc5322-mailbox.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

settings-sync.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

shared-calendar-colors.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

signature-utils.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

sub-addressing.ts

chore: update version to 1.6.2

2026-05-06 20:07:36 +02:00

subject-prefix.ts

fix: strip reply/forward prefixes followed by a full-width colon

2026-06-24 15:56:38 +02:00

template-types.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

template-utils.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

theme-color-meta.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

theme-compiler.ts

chore: update version to 1.5.3

2026-04-28 17:34:06 +02:00

theme-loader.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

thread-utils.ts

feat: Make it easier to handle multiple tags

2026-07-29 17:18:42 +02:00

tnef.ts

fix: standardize punctuation

2026-04-16 19:07:42 +02:00

unified-mailbox.ts

fix(unified-mailbox): single-source unified counters, unified id space, background push

2026-07-11 21:14:50 +02:00

utils.ts

feat(folders): drag-and-drop reorder for all folders

2026-07-21 20:56:38 +02:00

validation.ts

Fix: send mailto unsubscribe ourselves instead of via the OS handler

2026-07-08 15:41:46 +02:00

vcard.ts

feat: allow contact cards for organizations #701

2026-07-30 19:44:36 +02:00

version-compare.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

web-push.ts

ix: reap only relay-confirmed-dead leftover push subscriptions

2026-06-17 09:11:29 +02:00