summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
11 hoursdocs: unit-test NotmuchWorker against a throwaway databaseDanilo M.2-6/+22
The spec deferred NotmuchWorker to manual verification on the grounds that testing it needs a real notmuch database. Building a fake one in a temporary directory answers that objection, so Task 8 now gets real coverage. This is the only code in the project that writes to a notmuch index, so a bug there corrupts real mail state. It was the wrong place to have the weakest verification. Task 13's manual checklist stays, as confirmation against real data rather than as the only coverage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
11 hoursfeat: add cross-thread value types and notmuch RAII wrappersDanilo M.2-0/+102
ThreadSummary, MessageRef, and TagChange are plain-value structs that carry query results across the worker/UI thread boundary via queued signals. NmHandle<T, Destroy> wraps libnotmuch's C handles (query, threads, messages, thread, message, tags) so early returns in the query paths can't leak.
11 hoursfix: enforce !-free cidPrefix invariant at both concatenation sitesDanilo M.4-1/+98
The cid: namespacing scheme (cid:<prefix>!<id>) is only unambiguous because the prefix half is guaranteed free of '!': the first '!' in the result is always the separator, so an attacker-controlled Content-ID containing '!' only extends the id half rather than colliding with a different prefix. That invariant previously existed only as a comment. Add Q_ASSERT_X at both independent call sites that perform this concatenation (CidSchemeHandler::namespacedKey and HtmlBuilder::namespaceCids) so a future prefix generator that violates it traps in debug builds, per Task 5's precedent of not letting one unit's correctness depend silently on another's future behaviour. Since Q_ASSERT compiles out in release, pin the property that actually matters release builds too test: distinct (prefix, id) pairs across a documented "m<index>" prefix set and hostile Content-IDs (containing '!', percent- encoded '!', empty, leading/trailing '!') never collide, and the key always splits at its first '!' back to the exact original prefix.
11 hoursfeat: add HTML builder and cid: scheme handlerDanilo M.7-0/+544
HtmlBuilder renders parsed messages (and whole threads, as one document, so newsletter threads don't spawn one Chromium process per message) into the HTML string the web view loads. Plain text is escaped and quote lines marked; the cid: rewrite is namespaced per message ("<prefix>!<id>") so two thread messages sharing a Content-ID don't collide. Hardened namespaceCids beyond the initial sketch after attacking it: handles unquoted cid: attribute values, background=/poster= (not just src/href), and CSS url(cid:...) in both style="" attributes and <style> blocks, all case-insensitively. Replaced the greedy [^"']+ capture with per-quote-style alternation so two cid: refs on one line can't bleed into each other. CidSchemeHandler serves cid: requests from the thread's inline-parts map, keyed by the same namespaced string, replaced wholesale per thread.
11 hoursdocs: scope the document-load exemption to an exact URLDanilo M.2-3/+31
The interceptor previously trusted the whole qtmaildir: scheme, so a hostile message body referencing qtmaildir://anything would have been allowed. That made the interceptor's correctness depend on the scheme handler in a different, later task. It now trusts only the exact base URL passed to setHtml() and fails closed when none is set. Records the resulting obligation on MessageView to call setDocumentUrl() with that same URL. Also corrects the attachment path guard to a separator-aware comparison and notes that it is unreachable defence-in-depth: safeFilename() runs first, so no caller-supplied name can reach it. A test driving saveTo() expecting refusal cannot pass; test safeFilename() instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
11 hoursfix: scope qtmaildir: allow to the exact document base URLDanilo M.3-7/+95
Whole-scheme allow meant a hostile message body could reference any qtmaildir: URL (e.g. <img src="qtmaildir://other">) and have it pass, with safety depending entirely on Task 11's still-unwritten scheme handler. Add setDocumentUrl() and require an exact QUrl match; deny all qtmaildir: URLs when it is unset (fail closed). Document URL survives resetForNewMessage() since it is a property of the view, not of a message.
11 hoursfeat: add deny-by-default web request interceptorDanilo M.5-0/+339
11 hoursfix: make attachment path-containment guard separator-awareDanilo M.4-9/+119
Attachment::saveTo()'s escape guard compared paths with a bare QString::startsWith(), which is not a path-boundary test: "/tmp/safe-evil" textually starts with "/tmp/safe", so a sibling directory whose name merely extends the target's name would incorrectly pass as contained within it. Extract the check into Attachment::isPathInsideDirectory(), comparing QDir::cleanPath()'d absolute paths and requiring an exact match or a prefix ending at a '/' boundary. Not exploitable today since safeFilename() always reduces the name to a bare basename before saveTo() builds the target, so the guard is unreachable via saveTo()'s public interface; comments on both now say so plainly instead of implying it is currently load-bearing. Add pathInsideDirectoryRejectsSiblingPrefix, testing the guard directly (independent of safeFilename(), which would mask a broken guard by never producing an escaping path), and safeFilenameStripsPathComponents, testing the sanitiser that actually stops traversal today.
11 hoursfeat: add MimeParser with GMime and safe attachment namingDanilo M.12-0/+557
11 hoursfeat: add Config with account, query, and sync parsingDanilo M.7-8/+293
Accounts use [account.work] rather than [account/work]: QSettings' INI backend treats "/" as its own hierarchical group separator, so a literal slash in a section header parses as a nested group and trips QSettings::FormatError, silently breaking childGroups() enumeration. A dot carries no such meaning and keeps the format flat. Saved-query order is alphabetical (QSettings::childKeys() sorts), not file order; documented in code and tests rather than left to a false assumption.
11 hoursfix: report collisions between INI overrides bound to the same keyDanilo M.2-0/+65
loadOverrides() inserted straight into m_bindings, so two override lines that normalize to the same QKeySequence (e.g. "y" and "Y", both "Y" per QKeySequence) silently overwrote each other with zero warning, contradicting the "a typo cannot bind silently" contract on knownActions(). Track sequences seen within the current override pass separately from m_bindings (which already holds the defaults) so overriding a default key stays silent, but two colliding override lines produce one warning naming both actions.
11 hoursfeat: add KeyMap with defaults and INI overridesDanilo M.6-4/+248
Maps key sequences to action name strings, with hardcoded vim-style defaults and QSettings-based [keys] overrides. Unknown actions and unparseable sequences are collected as warnings rather than treated as fatal, so a typo in the config cannot silently misbind or crash. Note: QKeySequence::fromString() on Qt 6.11 does not return an empty sequence for unparseable input (e.g. "NotAKey++") -- it returns a non-empty sequence whose toString() is empty. Detection uses that instead of isEmpty().
11 hoursbuild: add CMake skeleton and dependency discoveryDanilo M.5-0/+57
11 hoursdocs: fold full thread rendering and batch tagging into spec and planDanilo M.2-89/+541
Both were narrowed in the first draft and are now in scope. Newsletter threads make whole-thread rendering fundamental, and bulk archive is the main thing a GUI buys over neomutt. Two consequences fell out of thread rendering and are recorded in both documents. The thread renders as one document in one web view rather than one view per message, since a view each would spawn a Chromium render process each. Sharing a document makes cid: references collide when two messages use the same Content-ID, which is common across newsletters from one sender, so every reference is namespaced to cid:<prefix>!<id>. Deciding which messages render expanded needs the query, so loadThread now intersects it with the thread and MessageRef carries a matched flag. Batch tagging resolves thread ids to message ids on the worker in one combined query. Undo stores thread ids and re-resolves, staying correct after the selection moves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
11 hoursdocs: add qtmaildir v1 implementation planDanilo M.1-0/+3988
Fourteen TDD tasks building from pure-logic units outward: keymap, config, MIME parsing, and the request interceptor are fully tested first, then the notmuch layer, then the UI that wires them together. Seven test binaries, up from the three the spec named; config, htmlbuilder, thread model, and sync each earned one. NotmuchWorker stays untested by design, with Task 13 as the compensating manual checklist against a real database. Two narrowings from the spec are recorded rather than silently dropped: thread rendering shows the newest message instead of a flat list of all messages, and tagging applies to the loaded thread rather than every selected one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
11 hoursdocs: add qtmaildir v1 design specDanilo M.2-0/+433
Qt6/notmuch mail client, GUI counterpart to neomutt. Read and organize only in v1; compose and send deferred to v2. Key decisions and their reasoning are recorded in the spec: C++/Qt6 over PySide6, QtWebEngine over QTextDocument for HTML mail, GMime for parsing, direct libnotmuch rather than shelling out to mailctl, and calling the existing sync script rather than reimplementing it so qtmaildir stays inside the flock guard shared with the hourly cron sync. Dependency availability verified on the development machine: Qt6 6.11.1 (WebEngine included in the monolithic package), libnotmuch 0.39, GMime 3.2.15. Notably notmuch installs no notmuch.pc, so CMake must locate it without pkg-config. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>