src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: block script-bearing MIME types from inline attachment preview

Browse Source
This commit is contained in:
Linus Rath
2026-05-18 12:47:44 +02:00
parent b1eb2b3c9b
commit 6ebf720688
2 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/email/email-viewer.tsx
+7 -2
View File
@@ -81,7 +81,7 @@ import { useTour } from "@/components/tour/tour-provider";
import { SmimePassphraseDialog } from "@/components/settings/smime-passphrase-dialog";
import { findCalendarAttachment, isCalendarMimeType } from "@/lib/calendar-invitation";
import { RecipientPopover } from "./recipient-popover";
import { isFilePreviewable } from "@/lib/file-preview";
import { isFilePreviewable, isMimeTypeSafeForInlinePreview } from "@/lib/file-preview";
import { SmimeStatusBanner } from "./smime-status-banner";
import { detectSmime } from "@/lib/smime/smime-detect";
import { smimeDecrypt, SmimeKeyLockedError, normalizeCmsBytes } from "@/lib/smime/smime-decrypt";
@@ -2535,7 +2535,12 @@ export function EmailViewer({
const handleEffectiveAttachmentOpen = useCallback(async (attachment: EffectiveAttachment) => {
const isPreviewable = isFilePreviewable(attachment.name || undefined, attachment.type);
const opensPreview = isPreviewable && mailAttachmentAction === 'preview';
// Blob URLs inherit our origin; script-bearing MIME types (text/html,
// image/svg+xml, etc.) would execute as the webmail origin if opened
// top-level. Force the download path for anything not on the inert allowlist.
const opensPreview = isPreviewable
&& mailAttachmentAction === 'preview'
&& isMimeTypeSafeForInlinePreview(attachment.type);
const info: AttachmentInfo = {
name: attachment.name || '',
lib/file-preview.ts
+20
View File
@@ -64,3 +64,23 @@ export function getFilePreviewKind(name?: string, type?: string): FilePreviewKin
export function isFilePreviewable(name?: string, type?: string): boolean {
return getFilePreviewKind(name, type) !== 'unsupported';
}
const INLINE_PREVIEW_SAFE_MIME_PREFIXES = ['image/', 'audio/', 'video/'];
const INLINE_PREVIEW_SAFE_MIME_TYPES = new Set(['application/pdf', 'text/plain']);
const INLINE_PREVIEW_UNSAFE_MIME_TYPES = new Set([
'image/svg+xml',
'image/svg',
]);
// Whether a Blob with this MIME type is safe to open as a top-level navigation
// (e.g. window.open on a blob: URL). Blob URLs inherit the creator's origin, so
// script-bearing types like text/html, application/xhtml+xml, image/svg+xml, and
// XML variants would execute in our origin. Only an explicit allowlist of inert
// types is permitted; everything else must be downloaded.
export function isMimeTypeSafeForInlinePreview(type?: string): boolean {
const mimeType = type?.split(';')[0]?.trim().toLowerCase() || '';
if (!mimeType) return false;
if (INLINE_PREVIEW_UNSAFE_MIME_TYPES.has(mimeType)) return false;
if (INLINE_PREVIEW_SAFE_MIME_TYPES.has(mimeType)) return true;
return INLINE_PREVIEW_SAFE_MIME_PREFIXES.some((prefix) => mimeType.startsWith(prefix));
}