frontend/src/mails.ts line 62 sets body.innerHTML = mail.getBody(); directly from the decrypted message body. That body is produced by conv.makeHtml(bodyInput.value) (Showdown) in frontend/src/newmail.ts line 129, which converts markdown but passes through arbitrary embedded raw HTML (script tags, event handler attributes, etc.) unsanitized. Since messages are authenticated only as 'this AES key decrypted successfully' and not content-filtered, any friend (or anyone who completes the friend-request/AES-key-exchange flow) can send a message whose body executes arbitrary JS in the app's webview when the recipient opens it — a stored XSS with access to the local gRPC client (friends list, ability to send/accept requests, etc.). Fix by sanitizing the HTML before assignment, e.g. add a sanitizer library (such as DOMPurify) in frontend/src/mails.ts and use body.innerHTML = DOMPurify.sanitize(mail.getBody()), or strip script/event-handler content before rendering.
Proposed by Veratex ideation and approved by a maintainer. Veratex will implement this automatically and open a pull request.
frontend/src/mails.ts line 62 sets
body.innerHTML = mail.getBody();directly from the decrypted message body. That body is produced byconv.makeHtml(bodyInput.value)(Showdown) in frontend/src/newmail.ts line 129, which converts markdown but passes through arbitrary embedded raw HTML (script tags, event handler attributes, etc.) unsanitized. Since messages are authenticated only as 'this AES key decrypted successfully' and not content-filtered, any friend (or anyone who completes the friend-request/AES-key-exchange flow) can send a message whose body executes arbitrary JS in the app's webview when the recipient opens it — a stored XSS with access to the local gRPC client (friends list, ability to send/accept requests, etc.). Fix by sanitizing the HTML before assignment, e.g. add a sanitizer library (such as DOMPurify) in frontend/src/mails.ts and usebody.innerHTML = DOMPurify.sanitize(mail.getBody()), or strip script/event-handler content before rendering.Proposed by Veratex ideation and approved by a maintainer. Veratex will implement this automatically and open a pull request.