lukasandClaude Opus 4.8
8c634f7967
Calendar plugin (webmail_plugin_calendar, non-removable core plugin): - Local calendars/events CRUD with RLS isolation; recurrence expanded at query time (DST-correct), EXDATE + detached-override merge. - Calendar app bundle: month/week/day/3-day views, mini-month, event form (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient autocomplete, Jitsi video call), event popover with RSVP badges, resizable/ collapsible left panel + theme toggle, overlap layout. - iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML + text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token) records accepted/declined/tentative per attendee. - "This and following" edit + scoped delete (this / this-and-following), with a delete confirmation dialog for recurring events. Core: - Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations section; date order follows time format (en-GB vs en-US) across Mail. - Plugin SDK: mail (send from a user's account), vault (envelope encrypt), multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed PluginPage. Mail HTML rendering: - Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like, strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so already-indexed mail re-sanitizes on view. - Attachments: a Content-Disposition: attachment part is a real attachment even when it also carries a Content-ID (fixes hidden invite.ics). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
89 lines
2.9 KiB
Python
89 lines
2.9 KiB
Python
"""HTML sanitization (SPEC §6.4, §10.4, I-8)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
|
|
from app.indexer.sanitize import sanitize_html
|
|
|
|
MID = uuid.uuid4()
|
|
|
|
|
|
def test_scripts_and_handlers_are_removed() -> None:
|
|
html = '<div onclick="evil()">hi<script>alert(1)</script></div>'
|
|
result = sanitize_html(html, MID)
|
|
assert "<script" not in result.html.lower()
|
|
assert "onclick" not in result.html.lower()
|
|
assert "hi" in result.html
|
|
|
|
|
|
def test_remote_image_is_blocked_and_flagged() -> None:
|
|
html = '<p>see <img src="http://tracker.example/pixel.gif"> this</p>'
|
|
result = sanitize_html(html, MID)
|
|
assert result.has_remote_images
|
|
assert "tracker.example" not in result.html
|
|
|
|
|
|
def test_cid_image_is_rewritten_to_endpoint() -> None:
|
|
html = '<img src="cid:logo123">'
|
|
result = sanitize_html(html, MID)
|
|
assert f"/api/messages/{MID}/cid/logo123" in result.html
|
|
assert not result.has_remote_images
|
|
|
|
|
|
def test_data_image_is_preserved() -> None:
|
|
html = '<img src="data:image/png;base64,iVBORw0KGgo=">'
|
|
result = sanitize_html(html, MID)
|
|
assert "data:image/png" in result.html
|
|
assert not result.has_remote_images
|
|
|
|
|
|
def test_safe_links_survive_with_rel() -> None:
|
|
html = '<a href="https://example.com">link</a>'
|
|
result = sanitize_html(html, MID)
|
|
assert "https://example.com" in result.html
|
|
assert "javascript:" not in result.html.lower()
|
|
|
|
|
|
def test_javascript_uri_is_stripped() -> None:
|
|
html = '<a href="javascript:alert(1)">x</a>'
|
|
result = sanitize_html(html, MID)
|
|
assert "javascript:" not in result.html.lower()
|
|
|
|
|
|
def test_sanitizer_version_reported() -> None:
|
|
result = sanitize_html("<p>hi</p>", MID)
|
|
assert result.sanitizer_v >= 1
|
|
|
|
|
|
def test_style_block_and_classes_are_kept() -> None:
|
|
# Mailers (e.g. Fastmail invites) put layout in a <style> block + classes.
|
|
html = '<style>.banner{color:#333}</style><div class="banner">hi</div>'
|
|
result = sanitize_html(html, MID)
|
|
assert "<style" in result.html.lower()
|
|
assert ".banner" in result.html
|
|
assert 'class="banner"' in result.html
|
|
|
|
|
|
def test_style_block_script_css_is_dropped() -> None:
|
|
html = '<style>.x{width:expression(alert(1))}</style><p class="x">hi</p>'
|
|
result = sanitize_html(html, MID)
|
|
assert "expression(" not in result.html.lower()
|
|
# the block is nuked but the element/class survive
|
|
assert 'class="x"' in result.html
|
|
|
|
|
|
def test_style_block_import_and_url_stripped_when_remote_blocked() -> None:
|
|
html = "<style>@import url('http://evil/x.css'); .b{background:url(http://evil/p.gif)}</style>"
|
|
result = sanitize_html(html, MID)
|
|
assert "@import" not in result.html.lower()
|
|
assert "evil" not in result.html.lower()
|
|
assert result.has_remote_images
|
|
|
|
|
|
def test_script_content_still_stripped_with_style_allowed() -> None:
|
|
html = "<script>alert(1)</script><style>.a{color:red}</style>"
|
|
result = sanitize_html(html, MID)
|
|
assert "alert(1)" not in result.html
|
|
assert ".a{color:red}" in result.html
|