Bug 371656 - HTML mail styles spill into message header: security risk
Summary: HTML mail styles spill into message header: security risk
Status: CONFIRMED
Alias: None
Product: kdepim
Classification: Applications
Component: messageviewer (show other bugs)
Version: GIT (master)
Platform: Neon Linux
: HI major
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
: 340621 359425 429393 441829 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-10-25 10:41 UTC by Gunter Ohrner
Modified: 2022-01-02 23:19 UTC (History)
7 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Correct header in plain text view. (33.42 KB, image/png)
2016-10-26 23:00 UTC, Gunter Ohrner
Details
Header re-formatted by the displayed HTML mail. (24.86 KB, image/png)
2016-10-26 23:01 UTC, Gunter Ohrner
Details
email message used for the screenshots (47.69 KB, application/mbox)
2016-10-27 10:25 UTC, Gunter Ohrner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gunter Ohrner 2016-10-25 10:41:17 UTC
kMail 5.3.3 pre

In several cases, a displayed HTML mail influences the fancy message header's style.

See the attached screenshots for reference - the screenshot taken in plain text view shows how the header should look like.

The screenshot taken in the HTML view shows how the mail's styles influence the header. Notice the missing borders around the header, the increased title text size and the messed-up formatting of the dspam status line.

BTW: The dspam status formatting differs from all other header line formattings, as it's expressed using completely different HTML tags:

*****************************************************************************
<tr><th>Date: </th>
<td dir="ltr">Di. 25.10.16 11:13</td></tr>
<tr><td colspan="2"><div class="spamheader" dir="ltr"><b>Spam Status:</b>&nbsp;<span style="padding-left: 20px;">DSpam <img src="data:image/PNG;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAABCAMAAADpTH4XAAAASFBMVEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///+qqqoAAAD2cKDYAAAAGHRSTlMAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wCysdQaAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAC0lEQVQImWMQxQIAEU8BpQ0ofWgAAAAASUVORK5CYII=" width="20" height="5" style="border: 1px solid black;" title="Mit 0.00 %iger Wahrscheinlichkeit Spam (Vertrauensniveau: 99.37 %).

Ausführlicher Bericht:
Wahrscheinlichkeit=0.0000
Vertrauensniveau=0.9937"> &nbsp;99.37% &nbsp;</span></div></td></tr>
*****************************************************************************

Reproducible: Always
Comment 1 Laurent Montel 2016-10-26 16:25:28 UTC
where is the screenshot ?:)
Comment 2 Gunter Ohrner 2016-10-26 23:00:42 UTC
Created attachment 101814 [details]
Correct header in plain text view.
Comment 3 Gunter Ohrner 2016-10-26 23:01:10 UTC
Created attachment 101815 [details]
Header re-formatted by the displayed HTML mail.
Comment 4 Gunter Ohrner 2016-10-26 23:01:55 UTC
Whoops, sorry.

Attached.

Did I mention that the "missing attachment warner" is one of kMail's most valuable features? :-D
Comment 5 Gunter Ohrner 2016-10-27 10:25:38 UTC
Created attachment 101831 [details]
email message used for the screenshots

Sorry, I also forgot to attach the testcase message... :-(

Here it is.
Comment 6 Erik Quaeghebeur 2021-12-30 23:53:07 UTC
Still an issue in 5.18.3 (apparently this version is not available in drop down menu).
This is actually an issue in messageviewer. It happens because the HTML message's header (including style) is used for the full message view, to which the header and attachment footers are added. So any HTML message style not explicitly overridden in the header theme, but different from the default KMail style can wreak havoc on the header. This cannot reasonably be fixed is the header themes. What should happen is that the HTML message is displayed in a separate box (iframe or something less intrusive) and that its header is not used for the full message view.
Comment 7 Erik Quaeghebeur 2021-12-31 12:41:01 UTC
*** Bug 359425 has been marked as a duplicate of this bug. ***
Comment 8 Erik Quaeghebeur 2021-12-31 12:45:40 UTC
*** Bug 340621 has been marked as a duplicate of this bug. ***
Comment 9 Jonathan Marten 2021-12-31 23:16:21 UTC
See also 441829, 429393, 317177
Comment 10 Erik Quaeghebeur 2022-01-01 10:10:50 UTC
*** Bug 441829 has been marked as a duplicate of this bug. ***
Comment 11 Erik Quaeghebeur 2022-01-01 10:22:30 UTC
*** Bug 429393 has been marked as a duplicate of this bug. ***
Comment 12 Erik Quaeghebeur 2022-01-01 10:31:38 UTC
As is clear from some bug reports marked as a duplicate of this one, this issue is a security risk. Namely, the HTML's CSS may apply changes in an adversarial way, to, e.g., make phising scams more credible and more difficult to detect by the user. I've added that this is a security risk to the header and increased the importance. I've also indicated that it is still present in the current development branch.

What has not yet been mentioned, I think, is that this issue can affect display of attachments.

Any ideas for fixing this are welcome. The current rendering engine is far more advanced than it was five years ago, so we may have better options now.
Comment 13 Erik Quaeghebeur 2022-01-02 23:19:36 UTC
1. I have looked at two webmail clients (Fastmail and Web Outlook) to see how they deal with this issue. They essentially seem to include a div with the HTML email that includes the style element for that email. While this is against the html spec (style may only be introduced in the head element), it seems to work decently.

2. After reading up on the current state of HTML, a possibly spec-compliant fix might be achieved using ‘Web Components’ <https://developer.mozilla.org/en-US/docs/Web/Web_Components>, using templates and/or slots. It seems designed mostly with dynamic pages in mind, bit may be usable even for kmail's relatively simple purpose. How exactly this could be done is not clear to me yet, TBH.