stb
released this
2026-08-22 12:27:36 +02:00
| 10 commits to main since this release
Security
- Sandboxed message rendering + a site-wide Content-Security-Policy. HTML email bodies now render inside a sandboxed
<iframe> with scripting disabled outright, instead of being injected into the app's own page, and every response now carries a strict CSP. Together these mean a bug in the HTML sanitizer alone is no longer enough to execute script or exfiltrate data from a viewed message.
- Removed the last third-party dependency (the API docs page's Swagger UI is now fully self-hosted instead of loaded from a CDN) — this is what made the strict CSP possible without carving out exceptions.
- Fixed an open redirect in the OIDC login flow: the post-login return URL is now validated to a same-origin path, closing a phishing vector where a legitimate-looking Deaddrop login link could end in a redirect to an attacker-controlled site.
- Fixed the most significant finding of a full security audit: the raw message-part API endpoint now always forces a file download, even for a message's own inline HTML body (which has no filename). Previously, navigating directly to that URL could render a sender's raw, unsanitized HTML inline in the app's own origin.
- Message expiry no longer trusts the sender's
Date: header. A sender could previously set an arbitrary future date on their own message to keep it around past its configured lifetime; expiry is now based on the mail server's own receipt timestamp instead.
- Added size limits on IMAP-sourced message bodies and API request bodies, to prevent a maliciously large message or request from exhausting memory.
general.secret now requires a minimum length (32 bytes) at startup, since it's the root key behind all signing, session, and OAuth-state security.- Added automated dependency vulnerability scanning (
govulncheck, npm audit) to the test suite — this immediately caught the Go toolchain being a few patch releases behind on several standard-library CVE fixes, now updated.
- Published
SECURITY.md, documenting Deaddrop's full security model (access control, control-message integrity, session/OIDC handling, and input handling from both IMAP and the API).
Fixes
- Fixed a bug affecting most real-world HTML email: message bodies encoded as quoted-printable or base64 (the vast majority of HTML emails, and any non-ASCII plain text) were served back still-encoded instead of decoded, so they displayed corrupted rather than as their actual content.
Other
- Various fixes to the CI/build pipeline (Forgejo Actions compatibility, and ensuring the full test suite runs cleanly from a fresh checkout).