Skip to content

fix(mail): warn before opening mismatched displayed links#1833

Open
KaannKara wants to merge 3 commits into
runbox:masterfrom
KaannKara:warn-mismatched-email-links
Open

fix(mail): warn before opening mismatched displayed links#1833
KaannKara wants to merge 3 commits into
runbox:masterfrom
KaannKara:warn-mismatched-email-links

Conversation

@KaannKara
Copy link
Copy Markdown

Fixes #1688.

Summary

  • Add a click interceptor for rendered message links that compares URL-like visible link text with the actual href.
  • Show the existing confirmation dialog before opening mismatched links, and only open the link after the user accepts.
  • Apply the same handling to sanitized inline HTML and srcdoc iframe HTML views, while preserving mailto compose handling.

Tests

  • npx tsc -p src/tsconfig.spec.json --noEmit
  • npx eslint src/app/mailviewer/singlemailviewer.component.ts src/app/mailviewer/singlemailviewer.component.spec.ts (passes with existing warnings)
  • npm run lint (passes with existing warnings)
  • npm run policy (passes; reports existing historical commit-message notes)
  • npm run build (passes with existing Angular/CommonJS warnings)
  • npm run test -- --watch=false --browsers=ChromeHeadless --include=src/app/mailviewer/singlemailviewer.component.spec.ts (blocked: ChromeHeadless launcher is not registered in this checkout)

AI use disclosure

  • Used OpenAI Codex to inspect the issue, implement the patch, and run local validation.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76fdf03efd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +320 to +323
confirmDialog.afterClosed().subscribe(result => {
if (result) {
const openedWindow = window.open(linkMismatch.href, '_blank', 'noopener');
if (openedWindow) {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Open confirmed links in a direct user-gesture handler

In warnBeforeOpeningMismatchedLink, the call to window.open happens inside afterClosed().subscribe(...), which runs after the dialog close flow rather than inside the original link click handler. In browsers with stricter popup-blocking heuristics (commonly Safari/Firefox and hardened Chrome settings), that loses transient user activation, so users can click “open link” and still get no tab/window because window.open is blocked and returns null. This introduces a real regression for mismatched links: they may become impossible to open even after explicit confirmation.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

#Mail: Show a popup indicating whether a clicked HTML link is identical to the link text

1 participant