fix: scope qtmaildir: allow to the exact document base URL

Whole-scheme allow meant a hostile message body could reference any
qtmaildir: URL (e.g. <img src="qtmaildir://other">) and have it pass,
with safety depending entirely on Task 11's still-unwritten scheme
handler. Add setDocumentUrl() and require an exact QUrl match; deny
all qtmaildir: URLs when it is unset (fail closed). Document URL
survives resetForNewMessage() since it is a property of the view, not
of a message.

1 files changed, 16 insertions, 1 deletions

diff --git a/src/requestinterceptor.h b/src/requestinterceptor.h
index 817a4d1..9cc100d 100644
--- a/src/requestinterceptor.h
+++ b/src/requestinterceptor.h
@@ -23,6 +23,16 @@ public:
     /// Content-IDs belonging to the currently displayed message.
     void setAllowedCids(const QSet<QString> &cids) { m_allowedCids = cids; }
 
+    /// The document's own base URL, i.e. the exact QUrl that MessageView passes
+    /// as the base URL argument to setHtml(). This is the ONLY qtmaildir: URL
+    /// that shouldAllow() will pass; every other URL on that scheme, including
+    /// sub-paths of this one, is denied. Task 11's MessageView MUST call this
+    /// with the same QUrl it hands to setHtml(), before rendering, or every
+    /// qtmaildir: load (including the document itself) will be blocked.
+    /// Defaults to empty, which denies all qtmaildir: URLs (fail closed).
+    void setDocumentUrl(const QUrl &url) { m_documentUrl = url; }
+    QUrl documentUrl() const { return m_documentUrl; }
+
     /// Per-message opt-in, triggered by the user clicking "Load remote content".
     /// Never persisted, never carried to the next message.
     void setAllowRemote(bool allow) { m_allowRemote = allow; }
@@ -32,11 +42,16 @@ public:
     bool blockedAnything() const { return m_blockedAnything; }
 
     /// Called before rendering a new message: clears both the remote grant and
-    /// the blocked flag.
+    /// the blocked flag. Does NOT clear the document URL: the base URL is a
+    /// property of the view (it is the same qtmaildir: origin the WebEngine
+    /// page navigates within), not of any one message, so MessageView is
+    /// expected to call setDocumentUrl() itself whenever that URL changes
+    /// rather than have it silently reset here.
     void resetForNewMessage();
 
 private:
     QSet<QString> m_allowedCids;
+    QUrl m_documentUrl;
     bool m_allowRemote = false;
     bool m_blockedAnything = false;
 };