Repository navigation
Releases
Link Guard 0.14.0
Link Guard 0.14.0
This release gives Link Guard a new design that fits Thunderbird and shares its
layout with Link Guard for Outlook, and it closes a gap in how links that carry
another destination are shown.
New design: the notice is now a notification bar in Thunderbird's style. It names
what it found – suspicious links, links to blocked sites, or links waiting for
approval – and counts warnings, unapproved and blocked links. Expanded, it groups
the destination hosts into Needs attention, Links that cannot be approved,
Not yet approved, Blocked and a collapsed Approved. Each host has a card with
its registrable domain in bold, its status, warnings and hints, its actions, a ⋯
menu and the list of its links with their full address and Show in message.
Allow permanently now approves the exact host directly; approving or blocking a
whole domain moved into the ⋯ menu. Light and dark mode follow Thunderbird.
Settings use the same look, with toggles and the Link Guard logo, which is now also
the add-on's icon in the Add-ons Manager.
Links that name a trusted site: a link such as click.example.info/r?u=https://www.example.org/
names a site you approved, but where it really leads is decided by click.example.info.
Such a link used to get no hint at all. It now shows an amber hint saying exactly that,
until the linking host itself is approved.
The permissions remain messagesRead, scripting, and storage. Thunderbird
151 or newer is required. The new interface texts in the 18 languages other than
English and German have not been reviewed by native speakers. See the security policy
for limitations. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.13.0
Link Guard 0.13.0
This release closes several ways a message could slip a link past Link Guard,
adds two warnings and makes large lists practical.
Security fixes: a link's destination is now decided from the URL Thunderbird
actually opens. A message with a <base href> could turn an empty href or a
bare #fragment into an unchecked web link; relative links now resolve against
the base as well. MathML links and links inside shadow trees are now inspected
and disabled until approved, and HTML <link> elements are hidden. The labels
next to links are protected against message CSS in the same way as the panel.
Link text that names a bare domain such as example.org is now compared with
the real destination.
New warnings: code or HTML in a link, the shape of a reflected XSS attack on
the linked site, and links that carry another destination, such as an
open redirect, Microsoft Safe Links or Proofpoint URL Defense, when that
destination is off-site and not approved. A link with code in it can only be
allowed for the current message. The "Unusual port" warning has been removed;
a link with an explicit port follows the approval of its host.
The notice shows warnings in red with a warning triangle. A blocked host now
offers only Unblock, behind a confirmation, and a block wins over every
approval. A new setting hides the destination label next to links for messages
whose layout it disturbs; it is on by default.
Imported lists may now hold 5,000 entries and 512 KiB each, still at most 20
lists. Host checks, lookalike detection and the background state were rebuilt
so that full lists do not slow down message display, and lookalikes of every
trusted domain are now detected, not only of the first 10,000.
The project has a logo and full user and developer documentation in docs/.
The permissions remain messagesRead, scripting, and storage. Thunderbird
151 or newer is required. The new interface texts in the 19 non-English
languages have not been reviewed by native speakers. See the security policy
for limitations. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.12.1
Link Guard 0.12.1
A small layout fix for Settings. The text boxes of the rule cards now line up
within each row, even when one card's description is longer, and the fields of
a warning rule (label, target, pattern and the remove button) share one height.
There are no functional changes compared with 0.12.0.
The permissions remain messagesRead, scripting, and storage. Thunderbird
151 or newer is required. See the security policy
for limitations. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.12.0
Link Guard 0.12.0
You can now decide which warnings Link Guard shows. Each built-in warning can be
switched off in Settings: lookalike domains, internationalized domain names,
misleading link text, credentials in the URL, IP addresses, unusual ports and
URL shorteners. A warning you switch off also stops requiring an extra
exact-host approval. A link whose analysis failed always keeps its warning.
You can also add your own warnings. A rule has a label and a regular expression
that is checked against the link's host, full URL or visible text. Rules can
come from Settings or from imported warning lists (a JSON file or an HTTPS URL,
format link-guard-warnings). Warning lists are shown for review, start
disabled, change only when you refresh them, and can only add warnings, never
approve a link. Patterns run on a small built-in engine whose matching time is
linear, so no rule can freeze Thunderbird; backreferences and lookaround are
not supported. If a message is too large to check within the limit, the
affected links keep a "rules not checked" warning.
Plain http:// links are no longer flagged as a risk.
Settings now show four separate cards for approved hosts, blocked hosts,
approved whole domains and blocked whole domains. Stored rules are unchanged.
Security fixes: SVG links that use xlink:href are now inspected and disabled
until approved, and the approval panel is isolated in a closed shadow root so
that a message's CSS can no longer hide or restyle it.
The permissions remain messagesRead, scripting, and storage. Thunderbird
151 or newer is required. The new interface texts in the 19 non-English
languages have not been reviewed by native speakers. See the security policy
for limitations. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.11.0
Link Guard 0.11.0
Link Guard now supports blocklists. A JSON list with "kind": "block" may
contain exact hosts and *.example.com whole-domain entries. Once you enable
it, a blocklist overrides your approvals and imported allowlists. Imports still
start disabled, and existing lists keep working as allowlists. Link Guard also
refuses a permanent approval for a host that an enabled blocklist blocks,
instead of saving an approval that has no effect.
Remote blocklists can update themselves about once a day. This is on by default
for enabled lists and can be switched off for each list in Settings. Allowlists
never update themselves. An automatic update is held for your review if it is
large or would block a host or domain you approved, and a failed or changed
list leaves the stored one active. Each fetch tells the list host your IP
address; subscribe only to sources you trust.
Imported blocklists can no longer weaken lookalike warnings for approved
domains, and message pages now load much faster with large lists. Ten more
interface languages are included, for twenty in total: Czech, Danish, Dutch,
Finnish, Hungarian, Korean, Swedish, Traditional Chinese, Turkish and
Ukrainian. The new translations have not been reviewed by native speakers.
The permissions remain messagesRead, scripting, and storage. Thunderbird
151 or newer is required. See the security policy
for limitations. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.10.1
Link Guard 0.10.1
When you block a host in a message, Link Guard now asks whether to block that
host alone or its whole registrable domain. Existing exact-host blocks remain
exact. Whole-domain approval and block rules are shown as *.example.com in
Settings. In Link Guard, that notation includes example.com itself and all
subdomains. Imported JSON lists still contain exact hosts only.
Whole-domain blocks take priority over saved and imported approvals. Explicit
temporary approval remains limited to the current message. Broad approvals
still exclude selected shared-content hosts. All ten interface languages have
the new scope prompt and rule explanations.
The permissions remain messagesRead, scripting, and storage. Thunderbird
151 or newer is required. See the security policy
for limitations. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.9.1
Link Guard 0.9.1
Link Guard now has ten complete interface languages: English, German, Spanish,
French, Brazilian Portuguese, Italian, Polish, Russian, Japanese, and
Simplified Chinese. It follows Thunderbird's interface language and uses
English when that language is not available, even if Thunderbird has a different
secondary language installed. Security warnings and approval controls are
localized as well.
The link approval policy and permissions are unchanged. Thunderbird 151 or
newer is required. Download link-guard-0.9.1.xpi below and install it through
Add-ons and Themes → Install Add-on From File. Review the requested
messagesRead, scripting, and storage permissions.
Link Guard cannot authenticate a sender or inspect a browser's final redirect
destination. See the security policy
for details. The XPI and SHA256SUMS are built only after the YubiKey-signed
tag passes verification.
Link Guard 0.8.0
Link Guard 0.8.0
This is the first regular GitHub release. It uses the same link policy and
permissions as 0.7.3; the release process now publishes reviewed notes and
still requires a YubiKey-signed tag.
Install
Download link-guard-0.8.0.xpi below. In Thunderbird, open Add-ons and
Themes → Install Add-on From File, select the XPI, and review its
permissions. Thunderbird 151 or newer is required. The extension requests
messagesRead, scripting, and storage, with no blanket host permission.
Behavior and limits
- Web links in displayed mail stay inactive until their exact host or an
explicitly chosen domain scope is approved. Temporary approvals last only
for the current message. - Lookalike domains, HTTP links, misleading visible URLs, and public shorteners
receive additional warnings. No default trusted-host list is included. - Link Guard cannot authenticate a sender, inspect a browser's final redirect
destination, or protect QR codes and attachments. Review the security
policy
before relying on it for sensitive mail.
The runtime was tested manually in Thunderbird 159 on macOS, including an
OpenPGP message, a restored message after restart, a remote-list preview, and
German and English UI. Other Thunderbird versions and operating systems have
not been tested live. The release XPI and SHA256SUMS are built by GitHub
Actions only after the YubiKey tag signature passes verification.