1// Package webmail implements a webmail client, serving html/js and providing an API for message actions and SSE endpoint for receiving real-time updates.

2package webmail

4// todo: should we be serving the messages/parts on a separate (sub)domain for user-content? to limit damage if the csp rules aren't enough.

6import (

7 "archive/zip"

8 "bytes"

9 "context"

10 "encoding/base64"

11 "encoding/json"

12 "errors"

13 "fmt"

14 "io"

15 "log/slog"

16 "mime"

17 "net/http"

18 "os"

19 "path/filepath"

20 "regexp"

21 "runtime/debug"

22 "strconv"

23 "strings"

25 _ "embed"

27 "golang.org/x/net/html"

29 "github.com/prometheus/client_golang/prometheus"

30 "github.com/prometheus/client_golang/prometheus/promauto"

32 "github.com/mjl-/bstore"

33 "github.com/mjl-/sherpa"

35 "github.com/mjl-/mox/message"

36 "github.com/mjl-/mox/metrics"

37 "github.com/mjl-/mox/mlog"

38 "github.com/mjl-/mox/mox-"

39 "github.com/mjl-/mox/moxio"

40 "github.com/mjl-/mox/store"

41 "github.com/mjl-/mox/webauth"

42 "github.com/mjl-/mox/webops"

43)

45var pkglog = mlog.New("webmail", nil)

47type ctxKey string

49// We pass the request to the sherpa handler so the TLS info can be used for

50// the Received header in submitted messages. Most API calls need just the

51// account name.

52var requestInfoCtxKey ctxKey = "requestInfo"

54type requestInfo struct {

55 Log mlog.Log

56 LoginAddress string

57 Account *store.Account // Nil only for methods Login and LoginPrep.

58 SessionToken store.SessionToken

59 Response http.ResponseWriter

60 Request *http.Request // For Proto and TLS connection state during message submit.

61}

63//go:embed webmail.html

64var webmailHTML []byte

66//go:embed webmail.js

67var webmailJS []byte

69//go:embed msg.html

70var webmailmsgHTML []byte

72//go:embed msg.js

73var webmailmsgJS []byte

75//go:embed text.html

76var webmailtextHTML []byte

78//go:embed text.js

79var webmailtextJS []byte

81var (

82 // Similar between ../webmail/webmail.go:/metricSubmission and ../smtpserver/server.go:/metricSubmission and ../webapisrv/server.go:/metricSubmission

83 metricSubmission = promauto.NewCounterVec(

84 prometheus.CounterOpts{

85 Name: "mox_webmail_submission_total",

86 Help: "Webmail message submission results, known values (those ending with error are server errors): ok, badfrom, messagelimiterror, recipientlimiterror, queueerror, storesenterror.",

87 },

88 []string{

89 "result",

90 },

91 )

92 metricServerErrors = promauto.NewCounterVec(

93 prometheus.CounterOpts{

94 Name: "mox_webmail_errors_total",

95 Help: "Webmail server errors, known values: dkimsign, submit.",

96 },

97 []string{

98 "error",

99 },

100 )

101 metricSSEConnections = promauto.NewGauge(

102 prometheus.GaugeOpts{

103 Name: "mox_webmail_sse_connections",

104 Help: "Number of active webmail SSE connections.",

105 },

106 )

107)

108

109func xcheckf(ctx context.Context, err error, format string, args ...any) {

110 if err == nil {

111 return

112 }

113 msg := fmt.Sprintf(format, args...)

114 errmsg := fmt.Sprintf("%s: %s", msg, err)

115 pkglog.WithContext(ctx).Errorx(msg, err)

116 code := "server:error"

117 if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {

118 code = "user:error"

119 }

120 panic(&sherpa.Error{Code: code, Message: errmsg})

121}

122

123func xcheckuserf(ctx context.Context, err error, format string, args ...any) {

124 if err == nil {

125 return

126 }

127 msg := fmt.Sprintf(format, args...)

128 errmsg := fmt.Sprintf("%s: %s", msg, err)

129 pkglog.WithContext(ctx).Errorx(msg, err)

130 panic(&sherpa.Error{Code: "user:error", Message: errmsg})

131}

132

133func xdbwrite(ctx context.Context, acc *store.Account, fn func(tx *bstore.Tx)) {

134 err := acc.DB.Write(ctx, func(tx *bstore.Tx) error {

135 fn(tx)

136 return nil

137 })

138 xcheckf(ctx, err, "transaction")

139}

140

141func xdbread(ctx context.Context, acc *store.Account, fn func(tx *bstore.Tx)) {

142 err := acc.DB.Read(ctx, func(tx *bstore.Tx) error {

143 fn(tx)

144 return nil

145 })

146 xcheckf(ctx, err, "transaction")

147}

148

149var webmailFile = &mox.WebappFile{

150 HTML: webmailHTML,

151 JS: webmailJS,

152 HTMLPath: filepath.FromSlash("webmail/webmail.html"),

153 JSPath: filepath.FromSlash("webmail/webmail.js"),

154}

155

156// Serve content, either from a file, or return the fallback data. Caller

157// should already have set the content-type. We use this to return a file from

158// the local file system (during development), or embedded in the binary (when

159// deployed).

160func serveContentFallback(log mlog.Log, w http.ResponseWriter, r *http.Request, path string, fallback []byte) {

161 f, err := os.Open(path)

162 if err == nil {

163 defer f.Close()

164 st, err := f.Stat()

165 if err == nil {

166 http.ServeContent(w, r, "", st.ModTime(), f)

167 return

168 }

169 }

170 http.ServeContent(w, r, "", mox.FallbackMtime(log), bytes.NewReader(fallback))

171}

172

173// Handler returns a handler for the webmail endpoints, customized for the max

174// message size coming from the listener and cookiePath.

175func Handler(maxMessageSize int64, cookiePath string, isForwarded bool, accountPath string) func(w http.ResponseWriter, r *http.Request) {

176 sh, err := makeSherpaHandler(maxMessageSize, cookiePath, isForwarded)

177 return func(w http.ResponseWriter, r *http.Request) {

178 if err != nil {

179 http.Error(w, "500 - internal server error - cannot handle requests", http.StatusInternalServerError)

180 return

181 }

182 handle(sh, isForwarded, accountPath, w, r)

183 }

184}

185

186func handle(apiHandler http.Handler, isForwarded bool, accountPath string, w http.ResponseWriter, r *http.Request) {

187 ctx := r.Context()

188 log := pkglog.WithContext(ctx).With(slog.String("userauth", ""))

189

190 // Server-sent event connection, for all initial data (list of mailboxes), list of

191 // messages, and all events afterwards. Authenticated through a token in the query

192 // string, which it got from a Token API call.

193 if r.URL.Path == "/events" {

194 serveEvents(ctx, log, accountPath, w, r)

195 return

196 }

197

198 defer func() {

199 x := recover()

200 if x == nil {

201 return

202 }

203 err, ok := x.(*sherpa.Error)

204 if !ok {

205 log.WithContext(ctx).Error("handle panic", slog.Any("err", x))

206 debug.PrintStack()

207 metrics.PanicInc(metrics.Webmailhandle)

208 panic(x)

209 }

210 if strings.HasPrefix(err.Code, "user:") {

211 log.Debugx("webmail user error", err)

212 http.Error(w, "400 - bad request - "+err.Message, http.StatusBadRequest)

213 } else {

214 log.Errorx("webmail server error", err)

215 http.Error(w, "500 - internal server error - "+err.Message, http.StatusInternalServerError)

216 }

217 }()

218

219 switch r.URL.Path {

220 case "/":

221 switch r.Method {

222 case "GET", "HEAD":

223 h := w.Header()

224 h.Set("X-Frame-Options", "deny")

225 h.Set("Referrer-Policy", "same-origin")

226 webmailFile.Serve(ctx, log, w, r)

227 default:

228 http.Error(w, "405 - method not allowed - use get", http.StatusMethodNotAllowed)

229 }

230 return

231

232 case "/msg.js", "/text.js":

233 switch r.Method {

234 default:

235 http.Error(w, "405 - method not allowed - use get", http.StatusMethodNotAllowed)

236 return

237 case "GET", "HEAD":

238 }

239

240 path := filepath.Join("webmail", r.URL.Path[1:])

241 var fallback = webmailmsgJS

242 if r.URL.Path == "/text.js" {

243 fallback = webmailtextJS

244 }

245

246 w.Header().Set("Content-Type", "application/javascript; charset=utf-8")

247 serveContentFallback(log, w, r, path, fallback)

248 return

249 }

250

251 isAPI := strings.HasPrefix(r.URL.Path, "/api/")

252 // Only allow POST for calls, they will not work cross-domain without CORS.

253 if isAPI && r.URL.Path != "/api/" && r.Method != "POST" {

254 http.Error(w, "405 - method not allowed - use post", http.StatusMethodNotAllowed)

255 return

256 }

257

258 var loginAddress, accName string

259 var sessionToken store.SessionToken

260 // All other URLs, except the login endpoint require some authentication.

261 if r.URL.Path != "/api/LoginPrep" && r.URL.Path != "/api/Login" {

262 var ok bool

263 isExport := r.URL.Path == "/export"

264 requireCSRF := isAPI || isExport

265 accName, sessionToken, loginAddress, ok = webauth.Check(ctx, log, webauth.Accounts, "webmail", isForwarded, w, r, isAPI, requireCSRF, isExport)

266 if !ok {

267 // Response has been written already.

268 return

269 }

270 }

271

272 if isAPI {

273 var acc *store.Account

274 if accName != "" {

275 log = log.With(slog.String("account", accName))

276 var err error

277 acc, err = store.OpenAccount(log, accName)

278 if err != nil {

279 log.Errorx("open account", err)

280 http.Error(w, "500 - internal server error - error opening account", http.StatusInternalServerError)

281 return

282 }

283 defer func() {

284 err := acc.Close()

285 log.Check(err, "closing account")

286 }()

287 }

288 reqInfo := requestInfo{log, loginAddress, acc, sessionToken, w, r}

289 ctx = context.WithValue(ctx, requestInfoCtxKey, reqInfo)

290 apiHandler.ServeHTTP(w, r.WithContext(ctx))

291 return

292 }

293

294 // We are now expecting the following URLs:

295 // .../export

296 // .../msg/<msgid>/{attachments.zip,parsedmessage.js,raw}

297 // .../msg/<msgid>/{,msg}{text,html,htmlexternal}

298 // .../msg/<msgid>/{view,viewtext,download}/<partid>

299

300 if r.URL.Path == "/export" {

301 webops.Export(log, accName, w, r)

302 return

303 }

304

305 if !strings.HasPrefix(r.URL.Path, "/msg/") {

306 http.NotFound(w, r)

307 return

308 }

309

310 t := strings.Split(r.URL.Path[len("/msg/"):], "/")

311 if len(t) < 2 {

312 http.NotFound(w, r)

313 return

314 }

315

316 id, err := strconv.ParseInt(t[0], 10, 64)

317 if err != nil || id == 0 {

318 http.NotFound(w, r)

319 return

320 }

321

322 // Many of the requests need either a message or a parsed part. Make it easy to

323 // fetch/prepare and cleanup. We only do all the work when the request seems legit

324 // (valid HTTP route and method).

325 xprepare := func() (acc *store.Account, m store.Message, msgr *store.MsgReader, p message.Part, cleanup func(), ok bool) {

326 if r.Method != "GET" {

327 http.Error(w, "405 - method not allowed - post required", http.StatusMethodNotAllowed)

328 return

329 }

330

331 defer func() {

332 if ok {

333 return

334 }

335 if msgr != nil {

336 err := msgr.Close()

337 log.Check(err, "closing message reader")

338 msgr = nil

339 }

340 if acc != nil {

341 err := acc.Close()

342 log.Check(err, "closing account")

343 acc = nil

344 }

345 }()

346

347 var err error

348

349 acc, err = store.OpenAccount(log, accName)

350 xcheckf(ctx, err, "open account")

351

352 m = store.Message{ID: id}

353 err = acc.DB.Get(ctx, &m)

354 if err == bstore.ErrAbsent || err == nil && m.Expunged {

355 http.NotFound(w, r)

356 return

357 }

358 xcheckf(ctx, err, "get message")

359

360 msgr = acc.MessageReader(m)

361

362 p, err = m.LoadPart(msgr)

363 xcheckf(ctx, err, "load parsed message")

364

365 cleanup = func() {

366 err := msgr.Close()

367 log.Check(err, "closing message reader")

368 err = acc.Close()

369 log.Check(err, "closing account")

370 }

371 ok = true

372 return

373 }

374

375 h := w.Header()

376

377 // We set a Content-Security-Policy header that is as strict as possible, depending

378 // on the type of message/part/html/js. We have to be careful because we are

379 // returning data that is coming in from external places. E.g. HTML could contain

380 // javascripts that we don't want to execute, especially not on our domain. We load

381 // resources in an iframe. The CSP policy starts out with default-src 'none' to

382 // disallow loading anything, then start allowing what is safe, such as inlined

383 // datauri images and inline styles. Data can only be loaded when the request is

384 // coming from the same origin (so other sites cannot include resources

385 // (messages/parts)).

386 //

387 // We want to load resources in sandbox-mode, causing the page to be loaded as from

388 // a different origin. If sameOrigin is set, we have a looser CSP policy:

389 // allow-same-origin is set so resources are loaded as coming from this same

390 // origin. This is needed for the msg* endpoints that render a message, where we

391 // load the message body in a separate iframe again (with stricter CSP again),

392 // which we need to access for its inner height. If allowSelfScript is also set

393 // (for "msgtext"), the CSP leaves out the sandbox entirely.

394 //

395 // If allowExternal is set, we allow loading image, media (audio/video), styles and

396 // fronts from external URLs as well as inline URI's. By default we don't allow any

397 // loading of content, except inlined images (we do that ourselves for images

398 // embedded in the email), and we allow inline styles (which are safely constrained

399 // to an iframe).

400 //

401 // If allowSelfScript is set, inline scripts and scripts from our origin are

402 // allowed. Used to display a message including header. The header is rendered with

403 // javascript, the content is rendered in a separate iframe with a CSP that doesn't

404 // have allowSelfScript.

405 headers := func(sameOrigin, allowExternal, allowSelfScript, allowSelfImg bool) {

406 // allow-popups is needed to make opening links in new tabs work.

407 sb := "sandbox allow-popups allow-popups-to-escape-sandbox; "

408 if sameOrigin && allowSelfScript {

409 // Sandbox with both allow-same-origin and allow-script would not provide security,

410 // and would give warning in console about that.

411 sb = ""

412 } else if sameOrigin {

413 sb = "sandbox allow-popups allow-popups-to-escape-sandbox allow-same-origin; "

414 }

415 script := ""

416 if allowSelfScript {

417 script = "; script-src 'unsafe-inline' 'self'; frame-src 'self'; connect-src 'self'"

418 }

419 var csp string

420 if allowExternal {

421 csp = sb + "frame-ancestors 'self'; default-src 'none'; img-src data: http: https: 'unsafe-inline'; style-src 'unsafe-inline' data: http: https:; font-src data: http: https: 'unsafe-inline'; media-src 'unsafe-inline' data: http: https:" + script

422 } else if allowSelfImg {

423 csp = sb + "frame-ancestors 'self'; default-src 'none'; img-src data: 'self'; style-src 'unsafe-inline'" + script

424 } else {

425 csp = sb + "frame-ancestors 'self'; default-src 'none'; img-src data:; style-src 'unsafe-inline'" + script

426 }

427 h.Set("Content-Security-Policy", csp)

428 h.Set("X-Frame-Options", "sameorigin") // Duplicate with CSP, but better too much than too little.

429 h.Set("X-Content-Type-Options", "nosniff")

430 h.Set("Referrer-Policy", "no-referrer")

431 }

432

433 switch {

434 case len(t) == 2 && t[1] == "attachments.zip":

435 acc, m, msgr, p, cleanup, ok := xprepare()

436 if !ok {

437 return

438 }

439 defer cleanup()

440 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}

441 // note: state is cleared by cleanup

442

443 mi, err := messageItem(log, m, &state)

444 xcheckf(ctx, err, "parsing message")

445

446 headers(false, false, false, false)

447 h.Set("Content-Type", "application/zip")

448 h.Set("Cache-Control", "no-store, max-age=0")

449 var subjectSlug string

450 if p.Envelope != nil {

451 s := p.Envelope.Subject

452 s = strings.ToLower(s)

453 s = regexp.MustCompile("[^a-z0-9_.-]").ReplaceAllString(s, "-")

454 s = regexp.MustCompile("--*").ReplaceAllString(s, "-")

455 s = strings.TrimLeft(s, "-")

456 s = strings.TrimRight(s, "-")

457 if s != "" {

458 s = "-" + s

459 }

460 subjectSlug = s

461 }

462 filename := fmt.Sprintf("email-%d-attachments-%s%s.zip", m.ID, m.Received.Format("20060102-150405"), subjectSlug)

463 cd := mime.FormatMediaType("attachment", map[string]string{"filename": filename})

464 h.Set("Content-Disposition", cd)

465

466 zw := zip.NewWriter(w)

467 names := map[string]bool{}

468 for _, a := range mi.Attachments {

469 ap := a.Part

470 name := tryDecodeParam(log, ap.ContentTypeParams["name"])

471 if name == "" {

472 // We don't check errors, this is all best-effort.

473 h, _ := ap.Header()

474 disposition := h.Get("Content-Disposition")

475 _, params, _ := mime.ParseMediaType(disposition)

476 name = tryDecodeParam(log, params["filename"])

477 }

478 if name != "" {

479 name = filepath.Base(name)

480 }

481 mt := strings.ToLower(ap.MediaType + "/" + ap.MediaSubType)

482 if name == "" || names[name] {

483 ext := filepath.Ext(name)

484 if ext == "" {

485 // Handle just a few basic types.

486 extensions := map[string]string{

487 "text/plain": ".txt",

488 "text/html": ".html",

489 "image/jpeg": ".jpg",

490 "image/png": ".png",

491 "image/gif": ".gif",

492 "application/zip": ".zip",

493 }

494 ext = extensions[mt]

495 if ext == "" {

496 ext = ".bin"

497 }

498 }

499 var stem string

500 if name != "" && strings.HasSuffix(name, ext) {

501 stem = strings.TrimSuffix(name, ext)

502 } else {

503 stem = "attachment"

504 for _, index := range a.Path {

505 stem += fmt.Sprintf("-%d", index)

506 }

507 }

508 name = stem + ext

509 seq := 0

510 for names[name] {

511 seq++

512 name = stem + fmt.Sprintf("-%d", seq) + ext

513 }

514 }

515 names[name] = true

516

517 fh := zip.FileHeader{

518 Name: name,

519 Modified: m.Received,

520 }

521 nodeflate := map[string]bool{

522 "application/x-bzip2": true,

523 "application/zip": true,

524 "application/x-zip-compressed": true,

525 "application/gzip": true,

526 "application/x-gzip": true,

527 "application/vnd.rar": true,

528 "application/x-rar-compressed": true,

529 "application/x-7z-compressed": true,

530 }

531 // Sniff content-type as well for compressed data.

532 buf := make([]byte, 512)

533 n, _ := io.ReadFull(ap.Reader(), buf)

534 var sniffmt string

535 if n > 0 {

536 sniffmt = strings.ToLower(http.DetectContentType(buf[:n]))

537 }

538 deflate := ap.MediaType != "VIDEO" && ap.MediaType != "AUDIO" && (ap.MediaType != "IMAGE" || ap.MediaSubType == "BMP") && !nodeflate[mt] && !nodeflate[sniffmt]

539 if deflate {

540 fh.Method = zip.Deflate

541 }

542 // We cannot return errors anymore: we have already sent an application/zip header.

543 if zf, err := zw.CreateHeader(&fh); err != nil {

544 log.Check(err, "adding to zip file")

545 return

546 } else if _, err := io.Copy(zf, ap.Reader()); err != nil {

547 log.Check(err, "writing to zip file")

548 return

549 }

550 }

551 err = zw.Close()

552 log.Check(err, "final write to zip file")

553

554 // Raw display of a message, as text/plain.

555 case len(t) == 2 && t[1] == "raw":

556 _, _, msgr, p, cleanup, ok := xprepare()

557 if !ok {

558 return

559 }

560 defer cleanup()

561

562 // We intentially use text/plain. We certainly don't want to return a format that

563 // browsers or users would think of executing. We do set the charset if available

564 // on the outer part. If present, we assume it may be relevant for other parts. If

565 // not, there is not much we could do better...

566 headers(false, false, false, false)

567 ct := "text/plain"

568 params := map[string]string{}

569 if charset := p.ContentTypeParams["charset"]; charset != "" {

570 params["charset"] = charset

571 }

572 h.Set("Content-Type", mime.FormatMediaType(ct, params))

573 h.Set("Cache-Control", "no-store, max-age=0")

574

575 _, err := io.Copy(w, &moxio.AtReader{R: msgr})

576 log.Check(err, "writing raw")

577

578 case len(t) == 2 && (t[1] == "msgtext" || t[1] == "msghtml" || t[1] == "msghtmlexternal"):

579 // msg.html has a javascript tag with message data, and javascript to render the

580 // message header like the regular webmail.html and to load the message body in a

581 // separate iframe with a separate request with stronger CSP.

582 acc, m, msgr, p, cleanup, ok := xprepare()

583 if !ok {

584 return

585 }

586 defer cleanup()

587

588 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}

589 // note: state is cleared by cleanup

590

591 pm, err := parsedMessage(log, m, &state, true, true)

592 xcheckf(ctx, err, "getting parsed message")

593 if t[1] == "msgtext" && len(pm.Texts) == 0 || t[1] != "msgtext" && !pm.HasHTML {

594 http.Error(w, "400 - bad request - no such part", http.StatusBadRequest)

595 return

596 }

597

598 sameorigin := true

599 loadExternal := t[1] == "msghtmlexternal"

600 allowSelfScript := true

601 headers(sameorigin, loadExternal, allowSelfScript, false)

602 h.Set("Content-Type", "text/html; charset=utf-8")

603 h.Set("Cache-Control", "no-store, max-age=0")

604

605 path := filepath.FromSlash("webmail/msg.html")

606 fallback := webmailmsgHTML

607 serveContentFallback(log, w, r, path, fallback)

608

609 case len(t) == 2 && t[1] == "parsedmessage.js":

610 // Used by msg.html, for the msg* endpoints, for the data needed to show all data

611 // except the message body.

612 // This is js with data inside instead so we can load it synchronously, which we do

613 // to get a "loaded" event after the page was actually loaded.

614

615 acc, m, msgr, p, cleanup, ok := xprepare()

616 if !ok {

617 return

618 }

619 defer cleanup()

620 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}

621 // note: state is cleared by cleanup

622

623 pm, err := parsedMessage(log, m, &state, true, true)

624 xcheckf(ctx, err, "parsing parsedmessage")

625 pmjson, err := json.Marshal(pm)

626 xcheckf(ctx, err, "marshal parsedmessage")

627

628 m.MsgPrefix = nil

629 m.ParsedBuf = nil

630 mi := MessageItem{m, pm.envelope, pm.attachments, pm.isSigned, pm.isEncrypted, pm.firstLine, false}

631 mijson, err := json.Marshal(mi)

632 xcheckf(ctx, err, "marshal messageitem")

633

634 headers(false, false, false, false)

635 h.Set("Content-Type", "application/javascript; charset=utf-8")

636 h.Set("Cache-Control", "no-store, max-age=0")

637

638 _, err = fmt.Fprintf(w, "window.messageItem = %s;\nwindow.parsedMessage = %s;\n", mijson, pmjson)

639 log.Check(err, "writing parsedmessage.js")

640

641 case len(t) == 2 && t[1] == "text":

642 // Returns text.html whichs loads the message data with a javascript tag and

643 // renders just the text content with the same code as webmail.html. Used by the

644 // iframe in the msgtext endpoint. Not used by the regular webmail viewer, it

645 // renders the text itself, with the same shared js code.

646 acc, m, msgr, p, cleanup, ok := xprepare()

647 if !ok {

648 return

649 }

650 defer cleanup()

651

652 state := msgState{acc: acc, m: m, msgr: msgr, part: &p}

653 // note: state is cleared by cleanup

654

655 pm, err := parsedMessage(log, m, &state, true, true)

656 xcheckf(ctx, err, "parsing parsedmessage")

657

658 if len(pm.Texts) == 0 {

659 http.Error(w, "400 - bad request - no text part in message", http.StatusBadRequest)

660 return

661 }

662

663 // Needed for inner document height for outer iframe height in separate message view.

664 sameorigin := true

665 allowSelfScript := true

666 allowSelfImg := true

667 headers(sameorigin, false, allowSelfScript, allowSelfImg)

668 h.Set("Content-Type", "text/html; charset=utf-8")

669 h.Set("Cache-Control", "no-store, max-age=0")

670

671 // We typically return the embedded file, but during development it's handy to load

672 // from disk.

673 path := filepath.FromSlash("webmail/text.html")

674 fallback := webmailtextHTML

675 serveContentFallback(log, w, r, path, fallback)

676

677 case len(t) == 2 && (t[1] == "html" || t[1] == "htmlexternal"):

678 // Returns the first HTML part, with "cid:" URIs replaced with an inlined datauri

679 // if the referenced Content-ID attachment can be found.

680 _, _, _, p, cleanup, ok := xprepare()

681 if !ok {

682 return

683 }

684 defer cleanup()

685

686 setHeaders := func() {

687 // Needed for inner document height for outer iframe height in separate message

688 // view. We only need that when displaying as a separate message on the msghtml*

689 // endpoints. When displaying in the regular webmail, we don't need to know the

690 // inner height so we load it as different origin, which should be safer.

691 sameorigin := r.URL.Query().Get("sameorigin") == "true"

692 allowExternal := strings.HasSuffix(t[1], "external")

693 headers(sameorigin, allowExternal, false, false)

694

695 h.Set("Content-Type", "text/html; charset=utf-8")

696 h.Set("Cache-Control", "no-store, max-age=0")

697 }

698

699 // todo: skip certain html parts? e.g. with content-disposition: attachment?

700 var done bool

701 var usePart func(p *message.Part, parents []*message.Part)

702 usePart = func(p *message.Part, parents []*message.Part) {

703 if done {

704 return

705 }

706 mt := p.MediaType + "/" + p.MediaSubType

707 switch mt {

708 case "TEXT/HTML":

709 done = true

710 err := inlineSanitizeHTML(log, setHeaders, w, p, parents)

711 if err != nil {

712 http.Error(w, "400 - bad request - "+err.Error(), http.StatusBadRequest)

713 }

714 return

715 }

716 parents = append(parents, p)

717 for _, sp := range p.Parts {

718 usePart(&sp, parents)

719 }

720 }

721 usePart(&p, nil)

722

723 if !done {

724 http.Error(w, "400 - bad request - no html part in message", http.StatusBadRequest)

725 }

726

727 case len(t) == 3 && (t[1] == "view" || t[1] == "viewtext" || t[1] == "download"):

728 // View any part, as referenced in the last element path. "0" is the whole message,

729 // 0.0 is the first subpart, etc. "view" returns it with the content-type from the

730 // message (could be dangerous, but we set strict CSP headers), "viewtext" returns

731 // data with a text/plain content-type so the browser will attempt to display it,

732 // and "download" adds a content-disposition header causing the browser the

733 // download the file.

734 _, _, _, p, cleanup, ok := xprepare()

735 if !ok {

736 return

737 }

738 defer cleanup()

739

740 paths := strings.Split(t[2], ".")

741 if len(paths) == 0 || paths[0] != "0" {

742 http.NotFound(w, r)

743 return

744 }

745 ap := p

746 for _, e := range paths[1:] {

747 index, err := strconv.ParseInt(e, 10, 32)

748 if err != nil || index < 0 || int(index) >= len(ap.Parts) {

749 http.NotFound(w, r)

750 return

751 }

752 ap = ap.Parts[int(index)]

753 }

754

755 headers(false, false, false, false)

756 var ct string

757 if t[1] == "viewtext" {

758 ct = "text/plain"

759 } else {

760 ct = strings.ToLower(ap.MediaType + "/" + ap.MediaSubType)

761 }

762 h.Set("Content-Type", ct)

763 h.Set("Cache-Control", "no-store, max-age=0")

764 if t[1] == "download" {

765 name := tryDecodeParam(log, ap.ContentTypeParams["name"])

766 if name == "" {

767 // We don't check errors, this is all best-effort.

768 h, _ := ap.Header()

769 disposition := h.Get("Content-Disposition")

770 _, params, _ := mime.ParseMediaType(disposition)

771 name = tryDecodeParam(log, params["filename"])

772 }

773 if name == "" {

774 name = "attachment.bin"

775 }

776 cd := mime.FormatMediaType("attachment", map[string]string{"filename": name})

777 h.Set("Content-Disposition", cd)

778 }

779

780 _, err := io.Copy(w, ap.Reader())

781 if err != nil && !moxio.IsClosed(err) {

782 log.Errorx("copying attachment", err)

783 }

784 default:

785 http.NotFound(w, r)

786 }

787}

788

789// inlineSanitizeHTML writes the part as HTML, with "cid:" URIs for html "src"

790// attributes inlined and with potentially dangerous tags removed (javascript). The

791// sanitizing is just a first layer of defense, CSP headers block execution of

792// scripts. If the HTML becomes too large, an error is returned. Before writing

793// HTML, setHeaders is called to write the required headers for content-type and

794// CSP. On error, setHeader is not called, no output is written and the caller

795// should write an error response.

796func inlineSanitizeHTML(log mlog.Log, setHeaders func(), w io.Writer, p *message.Part, parents []*message.Part) error {

797 // Prepare cids if there is a chance we will use them.

798 cids := map[string]*message.Part{}

799 for _, parent := range parents {

800 if parent.MediaType+"/"+parent.MediaSubType == "MULTIPART/RELATED" && p.DecodedSize < 2*1024*1024 {

801 for i, rp := range parent.Parts {

802 if rp.ContentID != "" {

803 cids[strings.ToLower(rp.ContentID)] = &parent.Parts[i]

804 }

805 }

806 }

807 }

808

809 node, err := html.Parse(p.ReaderUTF8OrBinary())

810 if err != nil {

811 return fmt.Errorf("parsing html: %v", err)

812 }

813

814 // We track size, if it becomes too much, we abort and still copy as regular html.

815 var totalSize int64

816 if err := inlineNode(node, cids, &totalSize); err != nil {

817 return fmt.Errorf("inline cid uris in html nodes: %w", err)

818 }

819 sanitizeNode(node)

820 setHeaders()

821 err = html.Render(w, node)

822 log.Check(err, "writing html")

823 return nil

824}

825

826// We inline cid: URIs into data: URIs. If a cid is missing in the

827// multipart/related, we ignore the error and continue with other HTML nodes. It

828// will probably just result in a "broken image". We limit the max size we

829// generate. We only replace "src" attributes that start with "cid:". A cid URI

830// could theoretically occur in many more places, like link href, and css url().

831// That's probably not common though. Let's wait for someone to need it.

832func inlineNode(node *html.Node, cids map[string]*message.Part, totalSize *int64) error {

833 for i, a := range node.Attr {

834 if a.Key != "src" || !caselessPrefix(a.Val, "cid:") || a.Namespace != "" {

835 continue

836 }

837 cid := a.Val[4:]

838 ap := cids["<"+strings.ToLower(cid)+">"]

839 if ap == nil {

840 // Missing cid, can happen with email, no need to stop returning data.

841 continue

842 }

843 *totalSize += ap.DecodedSize

844 if *totalSize >= 10*1024*1024 {

845 return fmt.Errorf("html too large")

846 }

847 var sb strings.Builder

848 if _, err := fmt.Fprintf(&sb, "data:%s;base64,", strings.ToLower(ap.MediaType+"/"+ap.MediaSubType)); err != nil {

849 return fmt.Errorf("writing datauri: %v", err)

850 }

851 w := base64.NewEncoder(base64.StdEncoding, &sb)

852 if _, err := io.Copy(w, ap.Reader()); err != nil {

853 return fmt.Errorf("writing base64 datauri: %v", err)

854 }

855 node.Attr[i].Val = sb.String()

856 }

857 for node = node.FirstChild; node != nil; node = node.NextSibling {

858 if err := inlineNode(node, cids, totalSize); err != nil {

859 return err

860 }

861 }

862 return nil

863}

864

865func caselessPrefix(k, pre string) bool {

866 return len(k) >= len(pre) && strings.EqualFold(k[:len(pre)], pre)

867}

868

869var targetable = map[string]bool{

870 "a": true,

871 "area": true,

872 "form": true,

873 "base": true,

874}

875

876// sanitizeNode removes script elements, on* attributes, javascript: href

877// attributes, adds target="_blank" to all links and to a base tag.

878func sanitizeNode(node *html.Node) {

879 i := 0

880 var haveTarget, haveRel bool

881 for i < len(node.Attr) {

882 a := node.Attr[i]

883 // Remove dangerous attributes.

884 if strings.HasPrefix(a.Key, "on") || a.Key == "href" && caselessPrefix(a.Val, "javascript:") || a.Key == "src" && caselessPrefix(a.Val, "data:text/html") {

885 copy(node.Attr[i:], node.Attr[i+1:])

886 node.Attr = node.Attr[:len(node.Attr)-1]

887 continue

888 }

889 if a.Key == "target" {

890 node.Attr[i].Val = "_blank"

891 haveTarget = true

892 }

893 if a.Key == "rel" && targetable[node.Data] {

894 node.Attr[i].Val = "noopener noreferrer"

895 haveRel = true

896 }

897 i++

898 }

899 // Ensure target attribute is set for elements that can have it.

900 if !haveTarget && node.Type == html.ElementNode && targetable[node.Data] {

901 node.Attr = append(node.Attr, html.Attribute{Key: "target", Val: "_blank"})

902 haveTarget = true

903 }

904 if haveTarget && !haveRel {

905 node.Attr = append(node.Attr, html.Attribute{Key: "rel", Val: "noopener noreferrer"})

906 }

907

908 parent := node

909 node = node.FirstChild

910 var haveBase bool

911 for node != nil {

912 // Set next now, we may remove cur, which clears its NextSibling.

913 cur := node

914 node = node.NextSibling

915

916 // Remove script elements.

917 if cur.Type == html.ElementNode && cur.Data == "script" {

918 parent.RemoveChild(cur)

919 continue

920 }

921 sanitizeNode(cur)

922 }

923 if parent.Type == html.ElementNode && parent.Data == "head" && !haveBase {

924 n := html.Node{Type: html.ElementNode, Data: "base", Attr: []html.Attribute{{Key: "target", Val: "_blank"}, {Key: "rel", Val: "noopener noreferrer"}}}

925 parent.AppendChild(&n)

926 }

927}

928