From 5c3d38ae659386b748ad8f3e33af9ed5bb8e205f Mon Sep 17 00:00:00 2001
From: sysops <sysops@LenovoT14Gen5>
Date: Wed, 5 Aug 2026 21:45:20 +0200
Subject: [PATCH] =?UTF-8?q?fix(security):=20Tracking-Pixel-Blocker=20l?=
 =?UTF-8?q?=C3=A4sst=20Backslash-Varianten=20von=20https://=20durch?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

EXTERNAL_URL_RE verlangte zwei Forward-Slashes, aber der WHATWG-URL-Parser
akzeptiert für http(s) auch Backslash als Authority-Slash: "https:/\/evil.com"
und "https:\\evil.com" lösen im Browser identisch zu "https://evil.com" auf,
wurden vom PROJ-76-Fix aber nicht erkannt. Ein Tracking-Pixel mit dieser
Schreibweise hätte trotz aktivierter Blockierung geladen und dem Absender
eine Lesebestätigung samt IP verraten.

Gefunden durch Security-Review der heutigen Session-Commits.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019j28kGcaJAhBnrYX34hGdt
---
 src/app/mail/[id]/page.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/app/mail/[id]/page.tsx b/src/app/mail/[id]/page.tsx
index de72729..f031830 100644
--- a/src/app/mail/[id]/page.tsx
+++ b/src/app/mail/[id]/page.tsx
@@ -81,7 +81,11 @@ function triggerDownload(blob: Blob, filename: string) {
 // pixel") to the sender. Covers src=, srcset=, background=, <link href=> and
 // CSS url() in <style> blocks / style= attributes. data:- and cid:-URIs stay
 // untouched so inline/archived content keeps rendering.
-const EXTERNAL_URL_RE = /^\s*(?:https?:)?\/\//i;
+// Matches http(s): schemes and protocol-relative URLs. WHATWG's URL parser
+// treats backslashes as authority slashes for special schemes too, so
+// "https:/\/evil.com" and "https:\\evil.com" resolve exactly like
+// "https://evil.com" in a real browser and must be caught as well.
+const EXTERNAL_URL_RE = /^\s*(?:https?\s*:|[/\\]\s*[/\\])/i;
 
 // Tags whose src= attribute triggers a network request.
 const SRC_TAGS = new Set(["img", "video", "audio", "source"]);