From 485e06b796603ef760576748fbd96bc177d5fa49 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Sun, 2 Aug 2026 17:40:54 +0200 Subject: fix: scope qtmaildir: allow to the exact document base URL Whole-scheme allow meant a hostile message body could reference any qtmaildir: URL (e.g. ) and have it pass, with safety depending entirely on Task 11's still-unwritten scheme handler. Add setDocumentUrl() and require an exact QUrl match; deny all qtmaildir: URLs when it is unset (fail closed). Document URL survives resetForNewMessage() since it is a property of the view, not of a message. --- src/requestinterceptor.cpp | 20 ++++++++++++++------ src/requestinterceptor.h | 17 ++++++++++++++++- 2 files changed, 30 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/src/requestinterceptor.cpp b/src/requestinterceptor.cpp index 0ce95ca..8fd2419 100644 --- a/src/requestinterceptor.cpp +++ b/src/requestinterceptor.cpp @@ -15,12 +15,20 @@ bool RequestInterceptor::shouldAllow(const QUrl &url) const QString scheme = url.scheme(); // The document itself is loaded via setHtml() with a qtmaildir: base URL, - // so that scheme must pass or nothing renders at all. This is unconditional - // on any path/host because Task 11's scheme handler is the only thing that - // can ever originate a qtmaildir: navigation in the first place; the message - // body cannot cause a request with this scheme, only reference cid:/http(s):. - if (scheme == QLatin1String("qtmaildir")) - return true; + // so a request for exactly that URL must pass or nothing renders at all. + // This is the ONLY trusted qtmaildir: URL: everything else on this scheme + // is denied, including sub-paths of it. A hostile message body can put + // arbitrary qtmaildir: URLs in , , etc., so this + // cannot be a whole-scheme allow; it must be an exact match against the + // one URL the application itself chose. If setDocumentUrl() was never + // called, m_documentUrl is a default-constructed (invalid, empty) QUrl, + // which cannot equal any real request URL, so this fails closed. + if (scheme == QLatin1String("qtmaildir")) { + if (!m_documentUrl.isEmpty() && url == m_documentUrl) + return true; + m_blockedAnything = true; + return false; + } // Inline parts of the current message only. if (scheme == QLatin1String("cid")) { diff --git a/src/requestinterceptor.h b/src/requestinterceptor.h index 817a4d1..9cc100d 100644 --- a/src/requestinterceptor.h +++ b/src/requestinterceptor.h @@ -23,6 +23,16 @@ public: /// Content-IDs belonging to the currently displayed message. void setAllowedCids(const QSet &cids) { m_allowedCids = cids; } + /// The document's own base URL, i.e. the exact QUrl that MessageView passes + /// as the base URL argument to setHtml(). This is the ONLY qtmaildir: URL + /// that shouldAllow() will pass; every other URL on that scheme, including + /// sub-paths of this one, is denied. Task 11's MessageView MUST call this + /// with the same QUrl it hands to setHtml(), before rendering, or every + /// qtmaildir: load (including the document itself) will be blocked. + /// Defaults to empty, which denies all qtmaildir: URLs (fail closed). + void setDocumentUrl(const QUrl &url) { m_documentUrl = url; } + QUrl documentUrl() const { return m_documentUrl; } + /// Per-message opt-in, triggered by the user clicking "Load remote content". /// Never persisted, never carried to the next message. void setAllowRemote(bool allow) { m_allowRemote = allow; } @@ -32,11 +42,16 @@ public: bool blockedAnything() const { return m_blockedAnything; } /// Called before rendering a new message: clears both the remote grant and - /// the blocked flag. + /// the blocked flag. Does NOT clear the document URL: the base URL is a + /// property of the view (it is the same qtmaildir: origin the WebEngine + /// page navigates within), not of any one message, so MessageView is + /// expected to call setDocumentUrl() itself whenever that URL changes + /// rather than have it silently reset here. void resetForNewMessage(); private: QSet m_allowedCids; + QUrl m_documentUrl; bool m_allowRemote = false; bool m_blockedAnything = false; }; -- cgit v1.2.3