Foundry376/Mailspring
1
1
Fork 0
mirror of https://github.com/Foundry376/Mailspring.git synced 2024-11-10 17:48:50 +08:00
Code Issues Projects Releases Packages Wiki Activity

Additionally disable object, media browser features via csp: none

Browse source
This commit is contained in:
Ben Gotow 2023-07-04 09:20:19 -05:00
parent 97957cf777
commit 31a8b5964a
5 changed files with 17 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
app/internal_packages/print/lib/print-window.ts
View file

@ -29,7 +29,7 @@ export default class PrintWindow {
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:;">
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:; object-src none; media-src none; manifest-src none;">
<meta charset="utf-8">
${styleTags}
<link rel="stylesheet" type="text/css" href="${stylesPath}">
@ -80,7 +80,9 @@ export default class PrintWindow {
contextIsolation: false,
},
});
require("@electron/remote").require("@electron/remote/main").enable(this.browserWin.webContents);
require('@electron/remote')
.require('@electron/remote/main')
.enable(this.browserWin.webContents);
this.browserWin.removeMenu();
fs.writeFileSync(tmpMessagesPath, `window.printMessages = ${printMessages}`);
fs.writeFileSync(this.tmpFile, content);

17
app/src/browser/main.js
View file

@ -89,10 +89,8 @@ const declareOptions = argv => {
// The options --enable-crashpad and --allow-file-access-from-files are added to the command line options by electron when opening a second instance of Mailspring.
// If they are not defined as boolean options here, they will "swallow" every argument that is passed after them. This leads to the "Send To" functionality not working
// if mailspring is already running.
options
.boolean('enable-crashpad')
options
.boolean('allow-file-access-from-files')
options.boolean('enable-crashpad');
options.boolean('allow-file-access-from-files');
options
.alias('h', 'help')
.boolean('h')
@ -334,17 +332,14 @@ const start = () => {
// Setting the Origin Header to 'localhost' when logging in on Office 365
// Otherwise O365 will produce a 400 error on the OAuth Login Process
const filter = {
urls: ["*://login.microsoftonline.com/*"]
urls: ['*://login.microsoftonline.com/*'],
};
session.defaultSession.webRequest.onBeforeSendHeaders(
filter,
(details, callback) => {
session.defaultSession.webRequest.onBeforeSendHeaders(filter, (details, callback) => {
console.log(details);
details.requestHeaders['Origin'] = 'localhost';
callback({ requestHeaders: details.requestHeaders });
}
);
});
// Block remote JS execution in a second way in case our <meta> tag approach
// is compromised somehow https://www.electronjs.org/docs/tutorial/security
@ -357,7 +352,7 @@ const start = () => {
responseHeaders: {
...details.responseHeaders,
'Content-Security-Policy': [
"default-src * mailspring:; script-src 'self' 'unsafe-inline' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:;",
"default-src * mailspring:; script-src 'self' 'unsafe-inline' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:; object-src none; media-src none; manifest-src none;",
],
},
});

2
app/static/db-migration.html
View file

@ -2,7 +2,7 @@
<html style="background: #fff">
<head>
<title>Updating Mailspring Database...</title>
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:;">
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:; object-src none; media-src none; manifest-src none;">
<style>
.progress {
position: relative;

2
app/static/db-vacuum.html
View file

@ -2,7 +2,7 @@
<html style="background: #fff">
<head>
<title>Preparing Mailspring...</title>
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:;">
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:; object-src none; media-src none; manifest-src none;">
<style>
.progress {
position: relative;

2
app/static/index.html
View file

@ -3,7 +3,7 @@
<head>
<title>Mailspring</title>
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:;">
<meta http-equiv="Content-Security-Policy" content="default-src * mailspring:; script-src 'self' chrome-extension://react-developer-tools; style-src * 'unsafe-inline' mailspring:; img-src * data: mailspring: file:; object-src none; media-src none; manifest-src none;">
<script src="index.js"></script>
</head>