Security
- Remote content opt-in now covers images only. Remote stylesheets (, @import) and web fonts are refused in both the CSP and the request interceptor, closing the dynamic-CSS and font-metric-oracle channels from PortSwigger's "CSS: the bomb inside your inbox".
- URL attributes are normalised the way a browser normalises them - character references resolved (numeric refs with optional semicolon, named via KCharsets plus the HTML 5 names it lacks), tab/LF/CR/NUL stripped - before the scheme is judged. Schemes are now allow-listed; mailove: is refused in sender markup.
Update check
- Fires 30s after launch, on reconnect and on opening Settings; gated on (last-check time, version checked against). Result cached so the marker shows at startup. Amber badge in the title row that erases itself after 30s and rests as a lemon glyph.
Bug fixes
- Tag scanning is quote-aware: a '>' inside a quoted attribute value no longer truncates a tag and leave the rest unexamined.
- Settings backup now copies the file at exit, refuses to copy an empty file over a good spare, and is never read back (=backup only).
- UI state no longer uses QML Settings, which rewrote every key from memory and reverted concurrent edits; each key is written on its own.
New tests added.
Contributors
import