From 4f16587564cf0fc52b8bfdab34434dba1fa83c3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bot=20of=20Thomas=20G=C3=BCttler?= Date: Thu, 14 May 2026 10:09:05 +0200 Subject: [PATCH] =?UTF-8?q?feat(P2):=20paginate=20email=20list=20=E2=80=94?= =?UTF-8?q?=20default=2050=20threads,=20Load=20more=20button=20(#42)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- PLAN_ISSUE_21.md | 59 +++++++ lib/core/repositories/email_repository.dart | 11 +- .../repositories/email_repository_impl.dart | 16 +- lib/ui/screens/email_list_screen.dart | 19 ++- plan-claude.md | 161 ++++++++++++++++++ .../account_sync_manager_test.dart | 13 +- test/unit/account_sync_manager_test.dart | 13 +- .../unit/account_sync_manager_test.mocks.dart | 16 +- test/unit/reliability_runner_test.dart | 13 +- test/unit/undo_service_test.mocks.dart | 16 +- test/widget/helpers.dart | 11 +- 11 files changed, 316 insertions(+), 32 deletions(-) create mode 100644 PLAN_ISSUE_21.md create mode 100644 plan-claude.md diff --git a/PLAN_ISSUE_21.md b/PLAN_ISSUE_21.md new file mode 100644 index 0000000..1c23c11 --- /dev/null +++ b/PLAN_ISSUE_21.md @@ -0,0 +1,59 @@ +# Implementation Plan: Secure WebView for HTML Emails (#21) + +## Goal +Replace the current `flutter_html` based rendering with a hardened WebView-based approach to improve rendering fidelity while strictly enforcing security and privacy. + +## 1. Dependency Management +- **Core**: `webview_flutter` (v4+) +- **Linux Platform**: `webview_flutter_linux` (Official community-supported or WebKitGTK based implementation). *Note: I will verify the exact package name during implementation.* +- **Utilities**: `url_launcher` (existing) for opening links in the system browser. + +## 2. Secure WebView Component (`lib/ui/widgets/secure_email_webview.dart`) +Create a new widget `SecureEmailWebView` that encapsulates the `WebViewWidget` and its controller. + +### Configuration & Hardening +- **Disable JavaScript**: `controller.setJavaScriptMode(JavaScriptMode.disabled)`. +- **Background**: Match the application theme (e.g., transparent or surface color). +- **Security Headers/CSP**: Inject a Content Security Policy via `` tag in the HTML wrapper: + - `default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:;` (Blocks all external assets by default). + +### Image Blocking Logic +- **Initial State**: Block remote images by injecting a CSP that restricts `img-src` to `data:` and local schemes. +- **Toggle Mechanism**: + - Provide a "Load Remote Images" button in the Flutter UI. + - When triggered, re-render the HTML with an updated CSP: `img-src * data:;`. + +### Link Interception & Phishing Protection +- Implement `NavigationDelegate.onNavigationRequest`. +- **Process**: + 1. Intercept any URL that doesn't start with `about:blank` or `data:`. + 2. Block the navigation in the WebView. + 3. Trigger a Flutter `showDialog` for confirmation. +- **Phishing Protection Dialog**: + - Show the full URL. + - **Bold the FQDN**: Parse the URL using `Uri.parse`. + - Example: `https://`**`important-bank.com`**`/login` + - "Open in Browser" button uses `url_launcher`. + +## 3. Integration Plan +### Step 1: Initialization +Modify `lib/main.dart` to initialize the Linux WebView platform (using `webview_flutter_linux` or similar) during app startup. + +### Step 2: Replace Renderer in Screens +- **EmailDetailScreen**: Replace `Html(...)` with `SecureEmailWebView(html: body.htmlBody!)`. +- **ThreadDetailScreen**: Replace `Html(...)` with `SecureEmailWebView(html: body.htmlBody!)`. +- Remove `flutter_html` imports and dependencies once migration is complete. + +## 4. Verification & Security Audit +- **Manual Tests**: + - Open emails with complex HTML layouts. + - Verify images are blocked initially. + - Verify "Load images" works. + - Click various links (http, https, mailto) and verify the confirmation dialog and FQDN bolding. +- **Security Check**: + - Verify that `