From 3e540e8b2c79006524ad11d3629361bde663db27 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Sun, 2 Aug 2026 17:37:48 +0200 Subject: feat: add deny-by-default web request interceptor --- src/requestinterceptor.h | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 src/requestinterceptor.h (limited to 'src/requestinterceptor.h') diff --git a/src/requestinterceptor.h b/src/requestinterceptor.h new file mode 100644 index 0000000..817a4d1 --- /dev/null +++ b/src/requestinterceptor.h @@ -0,0 +1,42 @@ +#pragma once + +#include +#include +#include + +/// Deny-by-default request policy for the message view. +/// +/// A message body is untrusted input from a stranger. Everything is blocked +/// unless explicitly permitted: remote loads leak the fact that a message was +/// read (tracking pixels) and file: loads would expose the local filesystem. +class RequestInterceptor : public QWebEngineUrlRequestInterceptor +{ + Q_OBJECT +public: + explicit RequestInterceptor(QObject *parent = nullptr); + + /// The whole policy, as a pure function so it can be tested directly. + bool shouldAllow(const QUrl &url); + + void interceptRequest(QWebEngineUrlRequestInfo &info) override; + + /// Content-IDs belonging to the currently displayed message. + void setAllowedCids(const QSet &cids) { m_allowedCids = cids; } + + /// Per-message opt-in, triggered by the user clicking "Load remote content". + /// Never persisted, never carried to the next message. + void setAllowRemote(bool allow) { m_allowRemote = allow; } + bool allowRemote() const { return m_allowRemote; } + + /// True once any request has been denied, so the UI can offer the button. + bool blockedAnything() const { return m_blockedAnything; } + + /// Called before rendering a new message: clears both the remote grant and + /// the blocked flag. + void resetForNewMessage(); + +private: + QSet m_allowedCids; + bool m_allowRemote = false; + bool m_blockedAnything = false; +}; -- cgit v1.2.3