diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/requestinterceptor.cpp | 20 | ||||
| -rw-r--r-- | src/requestinterceptor.h | 17 |
2 files changed, 30 insertions, 7 deletions
diff --git a/src/requestinterceptor.cpp b/src/requestinterceptor.cpp index 0ce95ca..8fd2419 100644 --- a/src/requestinterceptor.cpp +++ b/src/requestinterceptor.cpp @@ -15,12 +15,20 @@ bool RequestInterceptor::shouldAllow(const QUrl &url) const QString scheme = url.scheme(); // The document itself is loaded via setHtml() with a qtmaildir: base URL, - // so that scheme must pass or nothing renders at all. This is unconditional - // on any path/host because Task 11's scheme handler is the only thing that - // can ever originate a qtmaildir: navigation in the first place; the message - // body cannot cause a request with this scheme, only reference cid:/http(s):. - if (scheme == QLatin1String("qtmaildir")) - return true; + // so a request for exactly that URL must pass or nothing renders at all. + // This is the ONLY trusted qtmaildir: URL: everything else on this scheme + // is denied, including sub-paths of it. A hostile message body can put + // arbitrary qtmaildir: URLs in <img src>, <link href>, etc., so this + // cannot be a whole-scheme allow; it must be an exact match against the + // one URL the application itself chose. If setDocumentUrl() was never + // called, m_documentUrl is a default-constructed (invalid, empty) QUrl, + // which cannot equal any real request URL, so this fails closed. + if (scheme == QLatin1String("qtmaildir")) { + if (!m_documentUrl.isEmpty() && url == m_documentUrl) + return true; + m_blockedAnything = true; + return false; + } // Inline parts of the current message only. if (scheme == QLatin1String("cid")) { diff --git a/src/requestinterceptor.h b/src/requestinterceptor.h index 817a4d1..9cc100d 100644 --- a/src/requestinterceptor.h +++ b/src/requestinterceptor.h @@ -23,6 +23,16 @@ public: /// Content-IDs belonging to the currently displayed message. void setAllowedCids(const QSet<QString> &cids) { m_allowedCids = cids; } + /// The document's own base URL, i.e. the exact QUrl that MessageView passes + /// as the base URL argument to setHtml(). This is the ONLY qtmaildir: URL + /// that shouldAllow() will pass; every other URL on that scheme, including + /// sub-paths of this one, is denied. Task 11's MessageView MUST call this + /// with the same QUrl it hands to setHtml(), before rendering, or every + /// qtmaildir: load (including the document itself) will be blocked. + /// Defaults to empty, which denies all qtmaildir: URLs (fail closed). + void setDocumentUrl(const QUrl &url) { m_documentUrl = url; } + QUrl documentUrl() const { return m_documentUrl; } + /// Per-message opt-in, triggered by the user clicking "Load remote content". /// Never persisted, never carried to the next message. void setAllowRemote(bool allow) { m_allowRemote = allow; } @@ -32,11 +42,16 @@ public: bool blockedAnything() const { return m_blockedAnything; } /// Called before rendering a new message: clears both the remote grant and - /// the blocked flag. + /// the blocked flag. Does NOT clear the document URL: the base URL is a + /// property of the view (it is the same qtmaildir: origin the WebEngine + /// page navigates within), not of any one message, so MessageView is + /// expected to call setDocumentUrl() itself whenever that URL changes + /// rather than have it silently reset here. void resetForNewMessage(); private: QSet<QString> m_allowedCids; + QUrl m_documentUrl; bool m_allowRemote = false; bool m_blockedAnything = false; }; |