ghaymah_dev/postal
1
1
Fork 0
mirror of https://github.com/postalserver/postal.git synced 2026-10-18 18:26:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(messages): sandbox rendered email HTML as extra XSS defence

Browse Source 
The app-wide CSP already blocks inline script execution, but the HTML
preview iframe for a stored email was same-origin and un-sandboxed, and
the html_raw response had no per-action hardening. Add a sandbox on the
iframe and tighten the CSP on html_raw to script-src 'none' with
nosniff and no-referrer so the preview has defence in depth against a
future CSP bypass or regression.

Relates to GHSA-f6g9-8555-cw28.
This commit is contained in:
Adam Cooke
2026-04-24 22:12:27 +01:00
parent b611d577af
commit cad2aa6808
3 changed files with 71 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/views/messages/html.html.haml
+1 -1
View File
@@ -14,4 +14,4 @@
This means that we no longer store the raw data for this e-mail
or the e-mail didn't include a HTML part.
- else
%iframe{:width => "100%", :height => "100%", :src => html_raw_organization_server_message_path(organization, @server, @message.id)}
%iframe{:width => "100%", :height => "100%", :sandbox => "allow-popups allow-popups-to-escape-sandbox", :referrerpolicy => "no-referrer", :src => html_raw_organization_server_message_path(organization, @server, @message.id)}