fix: scope qtmaildir: allow to the exact document base URL

Whole-scheme allow meant a hostile message body could reference any
qtmaildir: URL (e.g. <img src="qtmaildir://other">) and have it pass,
with safety depending entirely on Task 11's still-unwritten scheme
handler. Add setDocumentUrl() and require an exact QUrl match; deny
all qtmaildir: URLs when it is unset (fail closed). Document URL
survives resetForNewMessage() since it is a property of the view, not
of a message.

3 files changed, 95 insertions, 7 deletions

diff --git a/src/requestinterceptor.cpp b/src/requestinterceptor.cpp
index 0ce95ca..8fd2419 100644
--- a/src/requestinterceptor.cpp
+++ b/src/requestinterceptor.cpp
@@ -15,12 +15,20 @@ bool RequestInterceptor::shouldAllow(const QUrl &url)
     const QString scheme = url.scheme();
 
     // The document itself is loaded via setHtml() with a qtmaildir: base URL,
-    // so that scheme must pass or nothing renders at all. This is unconditional
-    // on any path/host because Task 11's scheme handler is the only thing that
-    // can ever originate a qtmaildir: navigation in the first place; the message
-    // body cannot cause a request with this scheme, only reference cid:/http(s):.
-    if (scheme == QLatin1String("qtmaildir"))
-        return true;
+    // so a request for exactly that URL must pass or nothing renders at all.
+    // This is the ONLY trusted qtmaildir: URL: everything else on this scheme
+    // is denied, including sub-paths of it. A hostile message body can put
+    // arbitrary qtmaildir: URLs in <img src>, <link href>, etc., so this
+    // cannot be a whole-scheme allow; it must be an exact match against the
+    // one URL the application itself chose. If setDocumentUrl() was never
+    // called, m_documentUrl is a default-constructed (invalid, empty) QUrl,
+    // which cannot equal any real request URL, so this fails closed.
+    if (scheme == QLatin1String("qtmaildir")) {
+        if (!m_documentUrl.isEmpty() && url == m_documentUrl)
+            return true;
+        m_blockedAnything = true;
+        return false;
+    }
 
     // Inline parts of the current message only.
     if (scheme == QLatin1String("cid")) {
diff --git a/src/requestinterceptor.h b/src/requestinterceptor.h
index 817a4d1..9cc100d 100644
--- a/src/requestinterceptor.h
+++ b/src/requestinterceptor.h
@@ -23,6 +23,16 @@ public:
     /// Content-IDs belonging to the currently displayed message.
     void setAllowedCids(const QSet<QString> &cids) { m_allowedCids = cids; }
 
+    /// The document's own base URL, i.e. the exact QUrl that MessageView passes
+    /// as the base URL argument to setHtml(). This is the ONLY qtmaildir: URL
+    /// that shouldAllow() will pass; every other URL on that scheme, including
+    /// sub-paths of this one, is denied. Task 11's MessageView MUST call this
+    /// with the same QUrl it hands to setHtml(), before rendering, or every
+    /// qtmaildir: load (including the document itself) will be blocked.
+    /// Defaults to empty, which denies all qtmaildir: URLs (fail closed).
+    void setDocumentUrl(const QUrl &url) { m_documentUrl = url; }
+    QUrl documentUrl() const { return m_documentUrl; }
+
     /// Per-message opt-in, triggered by the user clicking "Load remote content".
     /// Never persisted, never carried to the next message.
     void setAllowRemote(bool allow) { m_allowRemote = allow; }
@@ -32,11 +42,16 @@ public:
     bool blockedAnything() const { return m_blockedAnything; }
 
     /// Called before rendering a new message: clears both the remote grant and
-    /// the blocked flag.
+    /// the blocked flag. Does NOT clear the document URL: the base URL is a
+    /// property of the view (it is the same qtmaildir: origin the WebEngine
+    /// page navigates within), not of any one message, so MessageView is
+    /// expected to call setDocumentUrl() itself whenever that URL changes
+    /// rather than have it silently reset here.
     void resetForNewMessage();
 
 private:
     QSet<QString> m_allowedCids;
+    QUrl m_documentUrl;
     bool m_allowRemote = false;
     bool m_blockedAnything = false;
 };
diff --git a/tests/test_interceptor.cpp b/tests/test_interceptor.cpp
index 498a997..fa0e50a 100644
--- a/tests/test_interceptor.cpp
+++ b/tests/test_interceptor.cpp
@@ -17,6 +17,10 @@ private slots:
     // Adversarial additions.
     void schemeIsCaseInsensitiveAndStillBlocked();
     void qtmaildirSchemeIsCaseInsensitiveAllow();
+    void qtmaildirDocumentUrlIsAllowed();
+    void qtmaildirOtherPathIsBlocked();
+    void qtmaildirBlockedWhenNoDocumentUrlSet();
+    void resetForNewMessageDoesNotClearDocumentUrl();
     void cidUrlDoesNotParseAsUserinfo();
     void cidPercentEncodingDoesNotBypassAllowlist();
     void javascriptSchemeBlocked();
@@ -112,10 +116,71 @@ void TestInterceptor::schemeIsCaseInsensitiveAndStillBlocked()
 
 void TestInterceptor::qtmaildirSchemeIsCaseInsensitiveAllow()
 {
+    // QUrl normalizes scheme (and host, for authority-form URLs) to lowercase
+    // on parse, so a differently-cased spelling of the exact document URL
+    // still compares equal via QUrl::operator== (verified empirically:
+    // QUrl("qtmaildir://message") == QUrl("QTMAILDIR://message") is true).
     RequestInterceptor interceptor;
+    interceptor.setDocumentUrl(QUrl(QStringLiteral("qtmaildir://body/index.html")));
     QVERIFY(interceptor.shouldAllow(QUrl(QStringLiteral("QTMAILDIR://body/index.html"))));
 }
 
+void TestInterceptor::qtmaildirDocumentUrlIsAllowed()
+{
+    RequestInterceptor interceptor;
+    const QUrl doc(QStringLiteral("qtmaildir://message"));
+    interceptor.setDocumentUrl(doc);
+    QVERIFY(interceptor.shouldAllow(doc));
+}
+
+void TestInterceptor::qtmaildirOtherPathIsBlocked()
+{
+    // Defense in depth: the qtmaildir: scheme is trusted only for the exact
+    // document URL the application itself set, never for the whole scheme.
+    // A hostile message body can put any qtmaildir: URL in <img src> or
+    // <link href>; none of these variants may pass.
+    RequestInterceptor interceptor;
+    interceptor.setDocumentUrl(QUrl(QStringLiteral("qtmaildir://message")));
+
+    // Path traversal off the document URL.
+    QVERIFY(!interceptor.shouldAllow(QUrl(QStringLiteral("qtmaildir://message/../etc"))));
+    // A different qtmaildir origin entirely.
+    QVERIFY(!interceptor.shouldAllow(QUrl(QStringLiteral("qtmaildir://other"))));
+    // Opaque (non-authority) form of the scheme.
+    QVERIFY(!interceptor.shouldAllow(QUrl(QStringLiteral("qtmaildir:whatever"))));
+    // A sub-path of the document URL is still not the document URL itself.
+    QVERIFY(!interceptor.shouldAllow(QUrl(QStringLiteral("qtmaildir://message/cid/foo"))));
+
+    QVERIFY(interceptor.blockedAnything());
+}
+
+void TestInterceptor::qtmaildirBlockedWhenNoDocumentUrlSet()
+{
+    // Fail closed: if MessageView forgets to call setDocumentUrl(), nothing
+    // on the qtmaildir: scheme should be reachable, not even the URL that
+    // would otherwise be the legitimate document.
+    RequestInterceptor interceptor;
+    QVERIFY(!interceptor.shouldAllow(QUrl(QStringLiteral("qtmaildir://message"))));
+}
+
+void TestInterceptor::resetForNewMessageDoesNotClearDocumentUrl()
+{
+    // The document/base URL is a property of the view's current navigation,
+    // not of an individual message's content, so switching to a new message
+    // (resetForNewMessage) must not force MessageView to re-supply it.
+    RequestInterceptor interceptor;
+    const QUrl doc(QStringLiteral("qtmaildir://message"));
+    interceptor.setDocumentUrl(doc);
+    interceptor.shouldAllow(QUrl(QStringLiteral("http://tracker.example/p.gif")));
+    QVERIFY(interceptor.blockedAnything());
+
+    interceptor.resetForNewMessage();
+
+    QVERIFY(!interceptor.blockedAnything());
+    QCOMPARE(interceptor.documentUrl(), doc);
+    QVERIFY(interceptor.shouldAllow(doc));
+}
+
 void TestInterceptor::cidUrlDoesNotParseAsUserinfo()
 {
     // Pin down QUrl's actual parsing of a cid: URL containing '@', so a