Adam Cooke cad2aa6808 fix(messages): sandbox rendered email HTML as extra XSS defence ...

The app-wide CSP already blocks inline script execution, but the HTML
preview iframe for a stored email was same-origin and un-sandboxed, and
the html_raw response had no per-action hardening. Add a sandbox on the
iframe and tighten the CSP on html_raw to script-src 'none' with
nosniff and no-referrer so the preview has defence in depth against a
future CSP bypass or regression.

Relates to GHSA-f6g9-8555-cw28.

2026-04-24 22:12:27 +01:00

..

_deliveries.html.haml

chore: upgrade rails to 7.0 and other dependencies

2024-02-23 22:51:37 +00:00

_header.html.haml

initial commit from appmail

2017-04-19 13:07:25 +01:00

_index.html.haml

fixes style issue on error when no messages found

2017-05-30 15:16:01 +01:00

_list.html.haml

feat: automatically remove queued messages with stale locks (#2872)

2024-03-12 11:37:29 +00:00

_message_header.html.haml

chore: upgrade rails to 7.0 and other dependencies

2024-02-23 22:51:37 +00:00

_search.html.haml

initial commit from appmail

2017-04-19 13:07:25 +01:00

activity.html.haml

chore: upgrade rails to 7.0 and other dependencies

2024-02-23 22:51:37 +00:00

attachments.html.haml

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

headers.html.haml

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

held.html.haml

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

html.html.haml

fix(messages): sandbox rendered email HTML as extra XSS defence

2026-04-24 22:12:27 +01:00

incoming.html.haml

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

new.html.haml

initial commit from appmail

2017-04-19 13:07:25 +01:00

outgoing.html.haml

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

plain.html.haml

a sad sad day in postal-land, no more puns.

2017-05-02 13:33:17 +01:00

show.html.haml

Consistently treat tinyint(1) fields in message database as booleans (#2380)

2023-03-22 13:49:48 +00:00

spam_checks.html.haml

initial commit from appmail

2017-04-19 13:07:25 +01:00

suppressions.html.haml

feat: new configuration system (and schema) (#2819)

2024-02-26 12:41:57 +00:00