Closed dab246 closed 3 weeks ago
This PR has been deployed to https://linagora.github.io/tmail-flutter/3245.
Add try/catch blocks to all email transformer and sanitize handler functions
Does this means that if I send a broken base64 link then HTML sanitizing is bypassed and thus I could pass an XSS payload after the broken base64 link?
Add try/catch blocks to all email transformer and sanitize handler functions
Does this means that if I send a broken base64 link then HTML sanitizing is bypassed and thus I could pass an XSS payload after the broken base64 link?
No. We do HTML sanitization before DOM processing. This error does not try/catch
function Uri.decodeFull(inputText)
when processing 3D links during DOM processing. So we always block XSS from the start.
please rebase @dab246
please rebase @dab246
Done. @hoangdat
Issue
3243
Root cause
Uri.decodeFull(inputText)
throws an exceptionFormatException: Invalid UTF-8 byte (at offset 11)
during handle3D Links
in DOM.Solution
try/catch
blocks to all emailtransformer
DOM handler functionsResolved
https://github.com/user-attachments/assets/de975aff-0f1d-454e-b41a-af26412e8aa8
demo-mobile.webm