From 485e06b796603ef760576748fbd96bc177d5fa49 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Sun, 2 Aug 2026 17:40:54 +0200 Subject: fix: scope qtmaildir: allow to the exact document base URL Whole-scheme allow meant a hostile message body could reference any qtmaildir: URL (e.g. ) and have it pass, with safety depending entirely on Task 11's still-unwritten scheme handler. Add setDocumentUrl() and require an exact QUrl match; deny all qtmaildir: URLs when it is unset (fail closed). Document URL survives resetForNewMessage() since it is a property of the view, not of a message. --- src/requestinterceptor.cpp | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) (limited to 'src/requestinterceptor.cpp') diff --git a/src/requestinterceptor.cpp b/src/requestinterceptor.cpp index 0ce95ca..8fd2419 100644 --- a/src/requestinterceptor.cpp +++ b/src/requestinterceptor.cpp @@ -15,12 +15,20 @@ bool RequestInterceptor::shouldAllow(const QUrl &url) const QString scheme = url.scheme(); // The document itself is loaded via setHtml() with a qtmaildir: base URL, - // so that scheme must pass or nothing renders at all. This is unconditional - // on any path/host because Task 11's scheme handler is the only thing that - // can ever originate a qtmaildir: navigation in the first place; the message - // body cannot cause a request with this scheme, only reference cid:/http(s):. - if (scheme == QLatin1String("qtmaildir")) - return true; + // so a request for exactly that URL must pass or nothing renders at all. + // This is the ONLY trusted qtmaildir: URL: everything else on this scheme + // is denied, including sub-paths of it. A hostile message body can put + // arbitrary qtmaildir: URLs in , , etc., so this + // cannot be a whole-scheme allow; it must be an exact match against the + // one URL the application itself chose. If setDocumentUrl() was never + // called, m_documentUrl is a default-constructed (invalid, empty) QUrl, + // which cannot equal any real request URL, so this fails closed. + if (scheme == QLatin1String("qtmaildir")) { + if (!m_documentUrl.isEmpty() && url == m_documentUrl) + return true; + m_blockedAnything = true; + return false; + } // Inline parts of the current message only. if (scheme == QLatin1String("cid")) { -- cgit v1.2.3