1696052 - File Attach Bug if Anchor Tag with data-URI is used in HTML Mail

Status: RESOLVED FIXED

(Thunderbird :: Message Compose Window, defect)

Description

[Lauritz]

Attachment: lh20210004.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.192 Safari/537.36

Steps to reproduce:

1. Create new mail
2. Insert HTML anchor as follows: <a href=data:1>test</a>
   
   
   
3. Submit mail and observe the following error:
   

Actual results:

If an HTML mail includes an anchor tag with href=data:1, Thunderbird apparently tries to attach a file to the mail to which it does not have access.

Expected results:

There should not be any file access if an anchor tag is received in this manner.

Comment 1

[Magnus Melin [:mkmelin]]

I believe it's only the message that's misleading... the send code always just use data it already got.
But, I can confirm sending fails also on trunk (with the new backend). There's an error in the console and the send button isn't getting re-enabled.

Ping, can you take a look? A bad uri in the message shouldn't prevent sending.

Comment 2

[Ping Chen [:rnons] (away)]

Attachment: Bug 1696052 - Fix sending anchor tag with invalid data uri. r=mkmelin

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/0f69f1f035e6
Fix sending anchor tag with invalid data uri. r=mkmelin

Comment 4

[Ping Chen [:rnons] (away)]

Attachment: 1696052-beta.patch

Rebased to beta, only conflict was all-thunderbird.js.

Comment 5

[Ping Chen [:rnons] (away)]

Attachment: 1696052-esr78.patch

Rebased to esr78, picked only changes to nsMsgSend.cpp and test.

Comment 6

[Ping Chen [:rnons] (away)]

Comment on attachment 9207357 [details] [diff] [review]
1696052-beta.patch

[Approval Request Comment]
Regression caused by (bug #): bug 1211292
User impact if declined: Unable to send message containing anchor tag with invalid data uri
Testing completed (on c-c, etc.): c-c
Risk to taking this patch (and alternatives if risky): low

Comment 7

[Ping Chen [:rnons] (away)]

Comment on attachment 9207358 [details] [diff] [review]
1696052-esr78.patch

[Approval Request Comment]
Regression caused by (bug #): Implemented like this years ago.
User impact if declined: Unable to send message containing anchor tag with invalid data uri
Testing completed (on c-c, etc.): c-c
Risk to taking this patch (and alternatives if risky): low

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 9207358 [details] [diff] [review]
1696052-esr78.patch

[Triage Comment]
Approved for beta

Comment 9

[Wayne Mery (:wsmwk)]

Comment on attachment 9207357 [details] [diff] [review]
1696052-beta.patch

[Triage Comment]
really approving for beta

Comment 10

[Rob Lemley [:rjl]]

Thunderbird 87.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/26b2bab6f84e

Comment 11

[Rob Lemley [:rjl]]

Thunderbird 78.9.0:
https://hg.mozilla.org/releases/comm-esr78/rev/40009c93d152