💌 A beautiful, fast and fully open source mail client for Mac, Windows and Linux.
Find a file
Evan Morikawa 06a1eb42b2 fix(iframe): catch relative and malformed uris
Summary:
Fixes T3252

When links were clicked with malformed, relative, or malicious href links
we'd perform default behavior instead of catching them.

If you have href="www.foo.bar" the browser by default thinks it's a
relative link. In our case it would prepend the full default base URI
which is file://path/to/edgehill. This would at best fail to do anything
and at worst execute an arbitrary file.

We now blacklist `file:` and check for the existence of a valid RFC 3986
schema on the URI.

Test Plan: manual

Reviewers: bengotow

Reviewed By: bengotow

Maniphest Tasks: T3252

Differential Revision: https://phab.nylas.com/D1888
2015-08-19 10:20:41 -07:00
apm feat(logging): Developer bar, verbose logging to logstash, Electron 0.26.0 2015-05-19 17:02:46 -07:00
arclib fix(drafts): Various improvements and fixes to drafts, draft state management 2015-02-03 16:24:31 -08:00
build fix(build-flow): Fix broken promise chaining in publish phase 2015-08-18 18:28:10 -07:00
docs-templates Move guides from Edgehill repo to Redwood and only generate docs from classes 2015-06-02 16:24:56 -07:00
dot-nylas refactor(cruft): remove old Atom docs and other cruft 2015-07-24 14:27:21 -07:00
exports perf(drafts): Cache results of running Autolinker, avoid props.children for EmailFrame, fix special case for new draft 2015-08-17 16:23:12 -07:00
internal_packages fix(keymaps): JSON => CSON during cibuild final phase 2015-08-18 14:50:53 -07:00
keymaps fix(keymaps): JSON => CSON during cibuild final phase 2015-08-18 14:50:53 -07:00
menus fix(preferences): Windows / Linux styling and adjustments 2015-08-14 16:24:53 -07:00
script fix(build-flow): New integration test at the end of mac builds 2015-08-18 18:04:47 -07:00
spec WIP: This is the initial diff for new folders & labels. 2015-07-16 11:54:20 -04:00
spec-nylas fix(iframe): catch relative and malformed uris 2015-08-19 10:20:41 -07:00
src fix(iframe): catch relative and malformed uris 2015-08-19 10:20:41 -07:00
static bump(version): 0.2.5 2015-08-18 10:57:37 -07:00
vendor fix(sqlite): Connect to sqlite directly rather than sending queries over IPC (twice...) 2015-07-30 18:09:20 -07:00
.arcconfig Separate notifications if less than five 2015-07-15 13:18:10 -07:00
.arclint Separate notifications if less than five 2015-07-15 13:18:10 -07:00
.gitattributes fix(drafts): Various improvements and fixes to drafts, draft state management 2015-02-03 16:24:31 -08:00
.gitignore feat(preferences): WIP Preferences panel 2015-08-14 15:40:11 -07:00
.gitmodules fix(drafts): Various improvements and fixes to drafts, draft state management 2015-02-03 16:24:31 -08:00
.node-version fix(drafts): Various improvements and fixes to drafts, draft state management 2015-02-03 16:24:31 -08:00
atom.sh refactor(code): replace all instances of atom-shell and AtomShell and atomShell 2015-05-20 10:20:10 -07:00
coffeelint.json feat(docs): New docs tasks and React 0.13.2 2015-04-24 11:33:10 -07:00
LICENSE.md refactor(cruft): remove old Atom docs and other cruft 2015-07-24 14:27:21 -07:00
package.json bump(version): 0.2.5 2015-08-18 10:57:37 -07:00
README.md fix(readme): Rip out Atom readme, replace with our own minimal one 2015-04-30 16:24:09 -07:00

Nylas Mail is a hackable platform for your personal data, built on Electron and the Nylas Platform APIs.

Building Nylas Mail

Extending Nylas Mail

It's easy to extend Nylas Mail using your favorite web technologies. Check out the Nylas Package API to get started, and the API reference for information about specific classes.