From 14843569125f7aeb4adaf547c323c8eb18961461 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Sun, 2 Aug 2026 17:40:54 +0200 Subject: fix: scope qtmaildir: allow to the exact document base URL Whole-scheme allow meant a hostile message body could reference any qtmaildir: URL (e.g. ) and have it pass, with safety depending entirely on Task 11's still-unwritten scheme handler. Add setDocumentUrl() and require an exact QUrl match; deny all qtmaildir: URLs when it is unset (fail closed). Document URL survives resetForNewMessage() since it is a property of the view, not of a message. --- src/requestinterceptor.h | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'src/requestinterceptor.h') diff --git a/src/requestinterceptor.h b/src/requestinterceptor.h index 817a4d1..9cc100d 100644 --- a/src/requestinterceptor.h +++ b/src/requestinterceptor.h @@ -23,6 +23,16 @@ public: /// Content-IDs belonging to the currently displayed message. void setAllowedCids(const QSet &cids) { m_allowedCids = cids; } + /// The document's own base URL, i.e. the exact QUrl that MessageView passes + /// as the base URL argument to setHtml(). This is the ONLY qtmaildir: URL + /// that shouldAllow() will pass; every other URL on that scheme, including + /// sub-paths of this one, is denied. Task 11's MessageView MUST call this + /// with the same QUrl it hands to setHtml(), before rendering, or every + /// qtmaildir: load (including the document itself) will be blocked. + /// Defaults to empty, which denies all qtmaildir: URLs (fail closed). + void setDocumentUrl(const QUrl &url) { m_documentUrl = url; } + QUrl documentUrl() const { return m_documentUrl; } + /// Per-message opt-in, triggered by the user clicking "Load remote content". /// Never persisted, never carried to the next message. void setAllowRemote(bool allow) { m_allowRemote = allow; } @@ -32,11 +42,16 @@ public: bool blockedAnything() const { return m_blockedAnything; } /// Called before rendering a new message: clears both the remote grant and - /// the blocked flag. + /// the blocked flag. Does NOT clear the document URL: the base URL is a + /// property of the view (it is the same qtmaildir: origin the WebEngine + /// page navigates within), not of any one message, so MessageView is + /// expected to call setDocumentUrl() itself whenever that URL changes + /// rather than have it silently reset here. void resetForNewMessage(); private: QSet m_allowedCids; + QUrl m_documentUrl; bool m_allowRemote = false; bool m_blockedAnything = false; }; -- cgit v1.2.3