Stefan HildebrandtandLinus Rath abd493fb4c feat: strip external url()/@import from <style> blocks in sanitizer (#457) ...

Defence-in-depth on top of the strict iframe img-src/media-src/font-src CSP
that already blocks <style>-tag fetches at the network level. The per-node
DOM walk in blockExternalResourcesOnNode only sees element attributes, so a
tracker hidden in a kept <style> block (background url(), @font-face, @import)
never passed through it.

Adds stripExternalStyleSheetCss(), wired into blockExternalResourcesOnNode for
STYLE nodes (so it's gated on shouldBlockExternal and drives the blocked-content
banner like every other vector). Decodes CSS escapes over the whole block first
so the escaped-keyword form \75\72\6C( -> url( is caught - a literal `url(`
match would miss it. Removes remote @import in both url() and bare-string forms.

2026-07-21 20:56:08 +02:00

..

helpers

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

account-ordering.test.ts

feat(accounts): pin default account on top + drag-to-reorder switcher

2026-07-04 14:51:46 +02:00

account-state-manager.test.ts

fix: isolate per-account state snapshots from leakage and mutation

2026-06-20 13:09:26 +02:00

auth-crypto.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

base-path.test.ts

fix: strip build-time basePath from router.push redirects after login #390

2026-06-12 00:23:00 +02:00

birthday-calendar.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

builtin-themes.test.ts

feat: add Aurora Glass built-in theme

2026-06-03 19:30:51 +02:00

caldav-discover-route.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

calendar-alerts.test.ts

fix: strike through cancelled events and mute their reminders #572

2026-07-07 23:26:36 +02:00

calendar-event-normalization.test.ts

fix: JSCalendar 2.0 recurrenceRule single-object compatibility 116

2026-03-31 00:11:04 +02:00

calendar-invitation.test.ts

feat: add calendar event normalization and sanitization functions with tests

2026-03-27 18:46:20 +01:00

calendar-participants.test.ts

fix: store event organizer as owner-only to prevent duplicate ORGANIZER/ATTENDEE

2026-07-09 13:45:04 +02:00

calendar-utils.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

color-transform.test.ts

feat: add participant scheduling with iTIP invitations and inline calendar invitation banner

2026-02-17 01:09:57 +01:00

config-route.test.ts

feat: per-domain branding overrides on /api/config, manifest, pwa-icon #332

2026-05-28 20:06:47 +02:00

csp-frame-origins.test.ts

feat: composer-sidebar slot + plugin-declared frame-src origins

2026-04-25 18:40:54 +02:00

dev-jmap-mock.test.ts

fix: standardize punctuation

2026-04-16 19:07:42 +02:00

domain-branding.test.ts

fix: use callable .get to detect Headers in pickRequestHost

2026-07-09 13:51:12 +02:00

download-filename.test.ts

feat: add "Download all" button to bundle attachments into a zip #466

2026-06-24 18:46:41 +02:00

email-composer-utils.test.ts

Feature: contact groups as single expandable recipient chips

2026-07-09 17:46:06 +02:00

email-headers.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

email-sanitization.test.ts

feat: strip external url()/@import from <style> blocks in sanitizer (#457)

2026-07-21 20:56:08 +02:00

email-threading.test.ts

fix: set In-Reply-To and References on replies #234

2026-04-30 01:25:04 +02:00

eml-import.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

favicon-badge.test.ts

feat: show unread count badge on favicon

2026-07-16 18:00:41 +02:00

file-preview.test.ts

feat: calendar invitations RSVP, trust assessment, file preview

2026-03-16 22:00:11 +01:00

health-route.test.ts

fix: enhance health check functionality with detailed memory diagnostics and stable liveness probe

2026-03-19 18:50:59 +01:00

host-theme.test.ts

fix: theme plugin slot iframes with host font + color tokens

2026-05-31 16:28:22 +02:00

html-to-text.test.ts

fix: preserve line breaks in generated text/plain alternative #421

2026-06-15 23:15:04 +02:00

impersonation-jwt.test.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

jitsi-plugin.test.ts

feat: implemented plugin configuration UI and calendar event action slot

2026-03-30 21:12:05 +02:00

jmap-client-resilience.test.ts

fix(unified-mailbox): single-source unified counters, unified id space, background push

2026-07-11 21:14:50 +02:00

jmap-contact-client.test.ts

fix: update getContacts test to use mockFetchOnce

2026-03-21 20:45:20 +01:00

jmap-file-capability.test.ts

fix: hide Files when account lacks filenode capability #563

2026-07-07 23:59:19 +02:00

jmap-file-share.test.ts

feat: JMAP file/folder sharing in Files app #408

2026-06-12 00:02:45 +02:00

jmap-identity-client.test.ts

feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

2026-02-16 18:51:30 +01:00

jmap-keyword-account.test.ts

fix: route keyword writes to the email's own account in unified view

2026-07-04 14:53:15 +02:00

jmap-passthrough.test.ts

feat: migrate Stalwart management API to JMAP x: methods (0.16)

2026-04-21 17:29:23 +02:00

jmap-send-threading.test.ts

fix(jmap): file post-send message with a full mailboxIds replacement

2026-07-16 17:58:19 +02:00

mailbox-deep-nesting.test.ts

fix: standardize punctuation

2026-04-16 19:07:42 +02:00

mailbox-label.test.ts

fix: localize special-folder names by JMAP role #404

2026-06-24 19:32:13 +02:00

mailbox-path.test.ts

fix: use canonical INBOX in Sieve filter paths #313

2026-05-22 11:51:25 +02:00

mailto.test.ts

feat: email a contact or group via the in-app composer

2026-06-19 12:29:43 +02:00

mdn.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

oauth-discovery.test.ts

fix(oauth): harden OIDC discovery (timeout, retry, serve-stale)

2026-07-16 17:56:19 +02:00

oauth-metadata-route.test.ts

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

oauth-pkce.test.ts

feat(auth): add RP-initiated logout and OAuth unit tests

2026-02-26 00:08:57 +01:00

plugin-hooks.test.ts

feat: add plugin/theme harness and admin dashboard

2026-03-25 00:44:03 +01:00

plugin-loader.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

plugin-slot.test.tsx

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

plugin-storage.test.ts

feat: add plugin/theme harness and admin dashboard

2026-03-25 00:44:03 +01:00

plugin-store.test.ts

feat: harden plugin sandbox and migrate in-tree plugins

2026-05-18 12:17:54 +02:00

plugin-types.test.ts

fix: repair pre-existing failing vitest suite

2026-06-19 23:53:20 +02:00

plugin-validator.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

protocol-handlers.test.ts

Feature/protocol handlers

2026-05-12 20:49:05 +02:00

quote-header.test.ts

fix: HTML-escape sender/subject in reply/forward quote header (#482)

2026-06-25 00:25:28 +02:00

recurrence-expansion.test.ts

chore: clear pre-commit eslint warnings (unused symbols, stale disables, test any)

2026-06-19 12:31:07 +02:00

reply-identity.test.ts

feat(compose): preselect identity of the active mailbox for new messages

2026-06-30 16:31:34 +02:00

search-utils.test.ts

feat: implement wildcard query functionality for enhanced search capabilities

2026-03-14 16:50:43 +01:00

session-cookie.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

shared-calendar-colors.test.ts

Feature: per-viewer colors for shared calendars (#345)

2026-05-31 15:52:27 +02:00

sieve-generator.test.ts

feat: Enhance external rule handling in Sieve parser and store #201

2026-04-16 17:22:52 +02:00

signature-append.test.ts

fix: sync identity stores and append signatures to outgoing emails (#15)

2026-03-15 16:07:45 +01:00

signature-utils.test.ts

fix: preserve HTML signature when sending a quick reply

2026-05-30 15:12:30 +02:00

stalwart-jmap-api.test.ts

fix: preserve POST across redirects in Stalwart JMAP passthrough #627

2026-07-16 22:51:07 +02:00

sub-addressing.test.ts

feat: allow custom sub-addressing delimiter character #239

2026-05-01 01:48:39 +02:00

subject-prefix.test.ts

fix: strip reply/forward prefixes followed by a full-width colon

2026-06-24 15:56:38 +02:00

template-utils.test.ts

feat(templates): add support for HTML templates

2026-07-19 10:10:31 +02:00

theme-compiler.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

theme-loader.test.ts

feat: add Theme API v2 with token compiler, skin slot

2026-04-28 15:39:13 +02:00

thread-utils.test.ts

Feature: pin emails to the top of the folder list

2026-07-06 13:36:25 +02:00

tnef.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00

translations.test.ts

fix: add email export/import localization keys for multiple languages

2026-03-18 18:00:51 +01:00

unified-mailbox-cross.test.ts

feat(unified-mailbox): enable search in the unified views

2026-07-11 21:14:39 +02:00

unified-mailbox.test.ts

fix: stop unified-mailbox from mutating client-returned email objects

2026-06-25 00:25:00 +02:00

url-guard.test.ts

fix: validate URLs before outbound fetch

2026-04-27 22:23:39 +02:00

validation.test.ts

Fix: send mailto unsubscribe ourselves instead of via the OS handler

2026-07-08 15:41:46 +02:00

vcard.test.ts

feat: implement vCard 4.0 parsing and generation support

2026-05-15 20:10:18 +02:00

verify-jmap-auth.test.ts

fix: pin JMAP auth verification to configured server URL #237

2026-04-30 15:34:14 +02:00

version-compare.test.ts

fix: warn + block install when app version is below plugin's minAppVersion

2026-05-16 18:11:52 +02:00

webdav-route.test.ts

test: add characterisation tests for untested integration seams

2026-06-19 23:52:42 +02:00