From d331f49802b924149a68966f4b415acc2879ee4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bot=20of=20Thomas=20G=C3=BCttler?= Date: Fri, 5 Jun 2026 06:02:45 +0000 Subject: [PATCH 01/75] chore(deps): update gradle to v9 --- android/gradle/wrapper/gradle-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/android/gradle/wrapper/gradle-wrapper.properties b/android/gradle/wrapper/gradle-wrapper.properties index 25a96fe..2f745f9 100644 --- a/android/gradle/wrapper/gradle-wrapper.properties +++ b/android/gradle/wrapper/gradle-wrapper.properties @@ -2,4 +2,4 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-all.zip -- 2.52.0 From 85c9df604bb72d9a7c6a2d3963aea4ab32fa9024 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20G=C3=BCttler?= Date: Fri, 5 Jun 2026 08:19:48 +0200 Subject: [PATCH 02/75] ... --- .pre-commit-config.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c9015ae..a722261 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -10,6 +10,11 @@ repos: - id: end-of-file-fixer - id: trailing-whitespace + - repo: https://github.com/guettli/pre-commit-branch-up-to-date + rev: v0.0.4 + hooks: + - id: branch-up-to-date + - repo: local hooks: - id: check-no-binary -- 2.52.0 From a56eca08514251ace341c4eb6496034572f486b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20G=C3=BCttler?= Date: Fri, 5 Jun 2026 08:21:13 +0200 Subject: [PATCH 03/75] clean up in README --- README.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/README.md b/README.md index 7f60efb..fbf1b30 100644 --- a/README.md +++ b/README.md @@ -216,8 +216,3 @@ test/ - **Settings** — list and remove accounts - **Search** — IMAP server-side search (subject + body); results shown inline, no navigation change - **Offline-first** — all reads come from local Drift/SQLite DB; network only for sync and send -# CI Trigger -# CI Trigger 2 -# Dummy commit to verify CI fixes -# Dummy commit 3 -# CI Trigger 1780415300 -- 2.52.0 From 2ceabcacf07db54a573e672d95f0cce940332e31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20G=C3=BCttler?= Date: Fri, 5 Jun 2026 08:34:50 +0200 Subject: [PATCH 04/75] clean up (on main) --- PLAN_ISSUE_21.md | 59 ------------------------------------------------ 1 file changed, 59 deletions(-) delete mode 100644 PLAN_ISSUE_21.md diff --git a/PLAN_ISSUE_21.md b/PLAN_ISSUE_21.md deleted file mode 100644 index 1c23c11..0000000 --- a/PLAN_ISSUE_21.md +++ /dev/null @@ -1,59 +0,0 @@ -# Implementation Plan: Secure WebView for HTML Emails (#21) - -## Goal -Replace the current `flutter_html` based rendering with a hardened WebView-based approach to improve rendering fidelity while strictly enforcing security and privacy. - -## 1. Dependency Management -- **Core**: `webview_flutter` (v4+) -- **Linux Platform**: `webview_flutter_linux` (Official community-supported or WebKitGTK based implementation). *Note: I will verify the exact package name during implementation.* -- **Utilities**: `url_launcher` (existing) for opening links in the system browser. - -## 2. Secure WebView Component (`lib/ui/widgets/secure_email_webview.dart`) -Create a new widget `SecureEmailWebView` that encapsulates the `WebViewWidget` and its controller. - -### Configuration & Hardening -- **Disable JavaScript**: `controller.setJavaScriptMode(JavaScriptMode.disabled)`. -- **Background**: Match the application theme (e.g., transparent or surface color). -- **Security Headers/CSP**: Inject a Content Security Policy via `` tag in the HTML wrapper: - - `default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:;` (Blocks all external assets by default). - -### Image Blocking Logic -- **Initial State**: Block remote images by injecting a CSP that restricts `img-src` to `data:` and local schemes. -- **Toggle Mechanism**: - - Provide a "Load Remote Images" button in the Flutter UI. - - When triggered, re-render the HTML with an updated CSP: `img-src * data:;`. - -### Link Interception & Phishing Protection -- Implement `NavigationDelegate.onNavigationRequest`. -- **Process**: - 1. Intercept any URL that doesn't start with `about:blank` or `data:`. - 2. Block the navigation in the WebView. - 3. Trigger a Flutter `showDialog` for confirmation. -- **Phishing Protection Dialog**: - - Show the full URL. - - **Bold the FQDN**: Parse the URL using `Uri.parse`. - - Example: `https://`**`important-bank.com`**`/login` - - "Open in Browser" button uses `url_launcher`. - -## 3. Integration Plan -### Step 1: Initialization -Modify `lib/main.dart` to initialize the Linux WebView platform (using `webview_flutter_linux` or similar) during app startup. - -### Step 2: Replace Renderer in Screens -- **EmailDetailScreen**: Replace `Html(...)` with `SecureEmailWebView(html: body.htmlBody!)`. -- **ThreadDetailScreen**: Replace `Html(...)` with `SecureEmailWebView(html: body.htmlBody!)`. -- Remove `flutter_html` imports and dependencies once migration is complete. - -## 4. Verification & Security Audit -- **Manual Tests**: - - Open emails with complex HTML layouts. - - Verify images are blocked initially. - - Verify "Load images" works. - - Click various links (http, https, mailto) and verify the confirmation dialog and FQDN bolding. -- **Security Check**: - - Verify that `