dealerweb b11c3e8932 fix: apply the data: URI allowlist to srcset candidates too ...

DOMPurify URI-tests srcset as a single string, so an allowed first
candidate waved every later one through - an SVG data: URI could ride
in behind a raster candidate on <img srcset> and <picture><source>.
Check every data: occurrence against the raster allowlist and drop the
whole attribute on one disallowed hit, including the external blocker's
data-blocked-srcset stash, which shares the hook pass with no ordering
guarantee. The token is captured through the metadata-ending comma so
the plain (non-base64) raster form keeps the same verdict as in src.

2026-08-12 17:47:51 +02:00

..

helpers

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

account-ordering.test.ts

feat(accounts): pin default account on top + drag-to-reorder switcher

2026-07-04 14:51:46 +02:00

account-state-manager.test.ts

fix: isolate per-account state snapshots from leakage and mutation

2026-06-20 13:09:26 +02:00

auth-crypto.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

base-path.test.ts

fix: strip build-time basePath from router.push redirects after login #390

2026-06-12 00:23:00 +02:00

birthday-calendar.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

builtin-themes.test.ts

feat: add Aurora Glass built-in theme

2026-06-03 19:30:51 +02:00

caldav-discover-route.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

calendar-alerts.test.ts

fix: strike through cancelled events and mute their reminders #572

2026-07-07 23:26:36 +02:00

calendar-event-normalization.test.ts

fix: JSCalendar 2.0 recurrenceRule single-object compatibility 116

2026-03-31 00:11:04 +02:00

calendar-invitation.test.ts

feat: add calendar event normalization and sanitization functions with tests

2026-03-27 18:46:20 +01:00

calendar-participants.test.ts

fix: stop re-adding the organizer to the attendee list on every save #731

2026-08-06 18:29:34 +02:00

calendar-utils.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

clear-cached-data.test.ts

feat(settings): add "Refresh cached data" recovery action

2026-07-21 20:58:55 +02:00

color-transform.test.ts

feat: add participant scheduling with iTIP invitations and inline calendar invitation banner

2026-02-17 01:09:57 +01:00

config-route.test.ts

test: fix broken suites

2026-07-22 18:56:09 +02:00

csp-frame-origins.test.ts

feat: composer-sidebar slot + plugin-declared frame-src origins

2026-04-25 18:40:54 +02:00

deep-links.test.ts

feat: deep links for mail, calendar, contacts, files, settings and improve screen reader support

2026-08-06 16:47:20 +02:00

dev-jmap-mock.test.ts

fix: sequence PWA and push onboarding

2026-08-03 15:31:17 +02:00

domain-branding.test.ts

fix: use callable .get to detect Headers in pickRequestHost

2026-07-09 13:51:12 +02:00

download-filename.test.ts

feat: add "Download all" button to bundle attachments into a zip #466

2026-06-24 18:46:41 +02:00

email-composer-utils.test.ts

fix: keep inline images when replying to octet-stream cid parts #543

2026-08-06 18:41:01 +02:00

email-headers.test.ts

fix: stop HELO spf=none from downgrading a MAIL FROM spf=pass #650

2026-07-21 23:03:34 +02:00

email-link-targets.integration.test.ts

feat(email): open external links in a new tab (safely)

2026-07-21 20:59:20 +02:00

email-sanitization.test.ts

fix: apply the data: URI allowlist to srcset candidates too

2026-08-12 17:47:51 +02:00

email-threading.test.ts

fix: set In-Reply-To and References on replies #234

2026-04-30 01:25:04 +02:00

eml-import.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

favicon-badge.test.ts

feat: show unread count badge on favicon

2026-07-16 18:00:41 +02:00

file-preview.test.ts

feat: calendar invitations RSVP, trust assessment, file preview

2026-03-16 22:00:11 +01:00

forward-as-attachment.test.ts

fix: avoid leaving TZ="undefined" when restoring an unset timezone

2026-07-29 13:31:56 +12:00

health-route.test.ts

fix: enhance health check functionality with detailed memory diagnostics and stable liveness probe

2026-03-19 18:50:59 +01:00

host-theme.test.ts

fix: theme plugin slot iframes with host font + color tokens

2026-05-31 16:28:22 +02:00

html-to-text.test.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

impersonation-jwt.test.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

jitsi-plugin.test.ts

feat: implemented plugin configuration UI and calendar event action slot

2026-03-30 21:12:05 +02:00

jmap-calendar-access.test.ts

Fix: stop re-probing shared accounts without calendar access

2026-07-23 14:55:34 +02:00

jmap-calendar-capability.test.ts

fix(jmap): hide Contacts and Calendars when account lacks capability

2026-07-28 17:15:07 -07:00

jmap-client-resilience.test.ts

fix: time out stalled JMAP requests so sends can't hang forever #702

2026-08-05 17:19:10 +02:00

jmap-contact-client.test.ts

fix: stop minting duplicate "Trusted Senders" address books #730

2026-08-06 15:07:54 +02:00

jmap-contacts-capability.test.ts

fix(jmap): hide Contacts and Calendars when account lacks capability

2026-07-28 17:15:07 -07:00

jmap-empty-mailbox.test.ts

fix: empty folder stopped after 500 emails #711

2026-07-30 19:40:25 +02:00

jmap-file-capability.test.ts

fix: hide Files when account lacks filenode capability #563

2026-07-07 23:59:19 +02:00

jmap-file-share.test.ts

feat: JMAP file/folder sharing in Files app #408

2026-06-12 00:02:45 +02:00

jmap-identity-client.test.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

jmap-keyword-account.test.ts

fix: route keyword writes to the email's own account in unified view

2026-07-04 14:53:15 +02:00

jmap-keyword-discovery.test.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

jmap-passthrough.test.ts

feat: migrate Stalwart management API to JMAP x: methods (0.16)

2026-04-21 17:29:23 +02:00

jmap-recipient-mailboxes.test.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

jmap-request-limits.test.ts

fix: make bulwark respect server limits

2026-07-30 22:11:40 +02:00

jmap-send-threading.test.ts

fix(jmap): file post-send message with a full mailboxIds replacement

2026-07-16 17:58:19 +02:00

keyboard.test.ts

fix: detect typing inside the QuotedHtml shadow island via composedPath #654

2026-07-21 23:26:51 +02:00

keyword-discovery.test.ts

feat: detect and import unrecognized JMAP keywords as tags #658

2026-08-06 18:44:14 +02:00

keyword-format.test.ts

feat: Add nesting of tags in a tree

2026-07-29 17:18:38 +02:00

keyword-nesting.test.ts

feat: allow hidden tags, either permanent or when there are no unread messages

2026-07-29 17:18:42 +02:00

layout-theme-color.test.ts

fix: honor configured PWA theme color in desktop title bar #671

2026-08-06 17:40:41 +02:00

mailbox-deep-nesting.test.ts

fix: standardize punctuation

2026-04-16 19:07:42 +02:00

mailbox-label.test.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mailbox-path.test.ts

fix: use canonical INBOX in Sieve filter paths #313

2026-05-22 11:51:25 +02:00

mailto.test.ts

feat: email a contact or group via the in-app composer

2026-06-19 12:29:43 +02:00

mdn.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

message-list-tabs-store.test.ts

feat: add message-list category tabs

2026-07-22 17:22:20 +02:00

oauth-discovery.test.ts

fix(oauth): harden OIDC discovery (timeout, retry, serve-stale)

2026-07-16 17:56:19 +02:00

oauth-metadata-route.test.ts

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

oauth-pkce.test.ts

feat(auth): add RP-initiated logout and OAuth unit tests

2026-02-26 00:08:57 +01:00

plugin-api-gates.test.ts

fix(plugins): make attachment offload workable and keep the write gate closed

2026-08-06 14:08:07 +02:00

plugin-hooks.test.ts

fix(plugins): make attachment offload workable and keep the write gate closed

2026-08-06 14:08:07 +02:00

plugin-loader.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

plugin-slot.test.tsx

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

plugin-storage.test.ts

feat: add plugin/theme harness and admin dashboard

2026-03-25 00:44:03 +01:00

plugin-store.test.ts

feat: harden plugin sandbox and migrate in-tree plugins

2026-05-18 12:17:54 +02:00

plugin-types.test.ts

feat(plugins): add new contact-cryptokeys UI slot

2026-07-24 18:10:37 +02:00

plugin-validator.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

protocol-handlers.test.ts

Feature/protocol handlers

2026-05-12 20:49:05 +02:00

quote-collapse.test.ts

feat: collapse quoted reply text behind a "..." toggle #480

2026-07-22 19:17:23 +02:00

quote-header.test.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

recurrence-expansion.test.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

reply-identity.test.ts

fix(email): restore the sender identity when reopening a draft

2026-07-23 19:36:33 +02:00

reply-recipients.test.ts

fix: reply to own thread message addresses original recipients #703

2026-07-30 19:02:39 +02:00

rfc5322-mailbox.test.ts

fix: split "Name <addr>" recipients into the JMAP name and email fields #672

2026-08-06 19:19:18 +02:00

search-utils.test.ts

feat: implement wildcard query functionality for enhanced search capabilities

2026-03-14 16:50:43 +01:00

session-cookie.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

shared-calendar-colors.test.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

sieve-generator.test.ts

feat: Enhance external rule handling in Sieve parser and store #201

2026-04-16 17:22:52 +02:00

signature-append.test.ts

fix: sync identity stores and append signatures to outgoing emails (#15)

2026-03-15 16:07:45 +01:00

signature-utils.test.ts

fix: preserve HTML signature when sending a quick reply

2026-05-30 15:12:30 +02:00

stalwart-jmap-api.test.ts

fix: preserve POST across redirects in Stalwart JMAP passthrough #627

2026-07-16 22:51:07 +02:00

sub-addressing.test.ts

feat: allow custom sub-addressing delimiter character #239

2026-05-01 01:48:39 +02:00

subject-prefix.test.ts

fix: strip reply/forward prefixes followed by a full-width colon

2026-06-24 15:56:38 +02:00

template-utils.test.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

theme-color-meta.test.ts

fix: sync PWA title bar colour with the active theme #671

2026-08-06 18:23:21 +02:00

theme-compiler.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

theme-loader.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

thread-utils.test.ts

feat: Make it easier to handle multiple tags

2026-07-29 17:18:42 +02:00

tnef.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

translations.test.ts

fix: add email export/import localization keys for multiple languages

2026-03-18 18:00:51 +01:00

unified-mailbox-cross.test.ts

feat(unified-mailbox): enable search in the unified views

2026-07-11 21:14:39 +02:00

unified-mailbox.test.ts

fix: stop unified-mailbox from mutating client-returned email objects

2026-06-25 00:25:00 +02:00

url-guard.test.ts

fix: validate URLs before outbound fetch

2026-04-27 22:23:39 +02:00

validation.test.ts

Fix: send mailto unsubscribe ourselves instead of via the OS handler

2026-07-08 15:41:46 +02:00

vcard.test.ts

feat: allow contact cards for organizations #701

2026-07-30 19:44:36 +02:00

verify-jmap-auth.test.ts

fix: pin JMAP auth verification to configured server URL #237

2026-04-30 15:34:14 +02:00

version-compare.test.ts

fix: warn + block install when app version is below plugin's minAppVersion

2026-05-16 18:11:52 +02:00

webdav-route.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00