Updated cargo lock

Cargo.lock

@@ -98,9 +98,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.75"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "080e9890a082662b09c1ad45f567faeeb47f22b5fb23895fbe1e651e718e25ca"
 
 [[package]]
 name = "anymap"
@@ -329,6 +329,12 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
 [[package]]
 name = "bimap"
 version = "0.6.3"
@@ -500,6 +506,16 @@ dependencies = [
  "version_check 0.9.4",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.6"
@@ -558,6 +574,24 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "css-inline"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0250ac93bbccb4f0a892507a4580178edddef5e8267650e294b4fe00597b0da8"
+dependencies = [
+ "cssparser 0.31.2",
+ "html5ever",
+ "indexmap 2.1.0",
+ "pico-args",
+ "rayon",
+ "reqwest",
+ "rustc-hash",
+ "selectors 0.25.0",
+ "smallvec",
+ "url 2.5.0",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.27.2"
@@ -575,6 +609,19 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.31.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b3df4f93e5fbbe73ec01ec8d3f68bba73107993a5b1e7519273c32db9b0d5be"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa 1.0.10",
+ "phf 0.10.1",
+ "smallvec",
+]
+
 [[package]]
 name = "cssparser-macros"
 version = "0.6.1"
@@ -1444,6 +1491,20 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+dependencies = [
+ "futures-util",
+ "http",
+ "hyper 0.14.27",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.58"
@@ -1590,6 +1651,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "ipnet"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
+
 [[package]]
 name = "is-terminal"
 version = "0.4.9"
@@ -1727,7 +1794,7 @@ checksum = "10662f7aad081ec900fd735be33076da75e0389400277dc3734e2b0aa02bb115"
 dependencies = [
  "bitflags 2.4.1",
  "cfg-if 1.0.0",
- "cssparser",
+ "cssparser 0.27.2",
  "encoding_rs",
  "hashbrown 0.13.2",
  "lazy_static",
@@ -1735,7 +1802,7 @@ dependencies = [
  "memchr",
  "mime 0.3.17",
  "safemem",
- "selectors",
+ "selectors 0.22.0",
  "thiserror",
 ]
 
@@ -2210,7 +2277,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3dfb61232e34fcb633f43d12c58f83c1df82962dcdfa565a4e866ffc17dafe12"
 dependencies = [
- "phf_macros",
+ "phf_macros 0.8.0",
  "phf_shared 0.8.0",
  "proc-macro-hack",
 ]
@@ -2221,7 +2288,9 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
 dependencies = [
+ "phf_macros 0.10.0",
  "phf_shared 0.10.0",
+ "proc-macro-hack",
 ]
 
 [[package]]
@@ -2278,6 +2347,20 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "phf_macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+dependencies = [
+ "phf_generator 0.10.0",
+ "phf_shared 0.10.0",
+ "proc-macro-hack",
+ "proc-macro2 1.0.70",
+ "quote 1.0.33",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.8.0"
@@ -2296,6 +2379,12 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "pico-args"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28b9b4df73455c861d7cbf8be42f01d3b373ed7f02e378d55fa84eafc6f638b1"
+
 [[package]]
 name = "pin-project"
 version = "1.1.3"
@@ -2641,6 +2730,60 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
+[[package]]
+name = "reqwest"
+version = "0.11.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
+dependencies = [
+ "base64 0.21.7",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper 0.14.27",
+ "hyper-rustls",
+ "ipnet",
+ "js-sys",
+ "log 0.4.20",
+ "mime 0.3.17",
+ "once_cell",
+ "percent-encoding 2.3.1",
+ "pin-project-lite",
+ "rustls",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "system-configuration",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "url 2.5.0",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots",
+ "winreg",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74"
+dependencies = [
+ "cc",
+ "getrandom 0.2.11",
+ "libc",
+ "spin",
+ "untrusted",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "rocket"
 version = "0.4.11"
@@ -2812,6 +2955,12 @@ version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.0"
@@ -2834,6 +2983,37 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.21.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+dependencies = [
+ "log 0.4.20",
+ "ring",
+ "rustls-webpki",
+ "sct",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@@ -2873,6 +3053,16 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "seed"
 version = "0.10.0"
@@ -2918,7 +3108,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df320f1889ac4ba6bc0cdc9c9af7af4bd64bb927bccdf32d81140dc1f9be12fe"
 dependencies = [
  "bitflags 1.2.1",
- "cssparser",
+ "cssparser 0.27.2",
  "derive_more",
  "fxhash",
  "log 0.4.20",
@@ -2926,11 +3116,30 @@ dependencies = [
  "phf 0.8.0",
  "phf_codegen 0.8.0",
  "precomputed-hash",
- "servo_arc",
+ "servo_arc 0.1.1",
  "smallvec",
  "thin-slice",
 ]
 
+[[package]]
+name = "selectors"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eb30575f3638fc8f6815f448d50cb1a2e255b0897985c8c59f4d37b72a07b06"
+dependencies = [
+ "bitflags 2.4.1",
+ "cssparser 0.31.2",
+ "derive_more",
+ "fxhash",
+ "log 0.4.20",
+ "new_debug_unreachable",
+ "phf 0.10.1",
+ "phf_codegen 0.10.0",
+ "precomputed-hash",
+ "servo_arc 0.3.0",
+ "smallvec",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.20"
@@ -3005,12 +3214,15 @@ name = "server"
 version = "0.1.0"
 dependencies = [
  "ammonia",
+ "anyhow",
  "async-graphql",
  "async-graphql-rocket",
+ "css-inline",
  "glog",
  "log 0.4.20",
  "lol_html",
  "mailparse",
+ "maplit",
  "memmap",
  "notmuch",
  "rocket 0.5.0",
@@ -3034,6 +3246,15 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "servo_arc"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d036d71a959e00c77a63538b90a6c2390969f9772b096ea837205c6bd0491a44"
+dependencies = [
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.8"
@@ -3256,6 +3477,27 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.2.1",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.8.1"
@@ -3408,6 +3650,16 @@ dependencies = [
  "syn 2.0.40",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-stream"
 version = "0.1.14"
@@ -3715,6 +3967,12 @@ dependencies = [
  "traitobject",
 ]
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "1.7.2"
@@ -3935,6 +4193,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.25.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
+
 [[package]]
 name = "whoami"
 version = "1.4.1"
@@ -4174,6 +4438,16 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if 1.0.0",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "ws2_32-sys"
 version = "0.2.1"

server/Cargo.toml

@@ -2,7 +2,7 @@
 name = "server"
 version = "0.1.0"
 edition = "2021"
-default-bin = "server"
+default-run = "server"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -24,6 +24,9 @@ memmap = "0.7.0"
 mailparse = "0.14.0"
 ammonia = "3.3.0"
 lol_html = "1.2.0"
+css-inline = "0.13.0"
+anyhow = "1.0.79"
+maplit = "1.0.2"
 
 [dependencies.rocket_contrib]
 version = "0.4.11"

server/src/bin/cleanhtml.rs

@@ -0,0 +1,16 @@
+use std::fs;
+
+use server::sanitize_html;
+
+fn main() -> anyhow::Result<()> {
+    let mut args = std::env::args().skip(1);
+    let src = args.next().expect("source not specified");
+    let dst = args.next().expect("destination not specified");
+    println!("Sanitizing {src} into {dst}");
+    let bytes = fs::read(src)?;
+    let html = String::from_utf8_lossy(&bytes);
+    let html = sanitize_html(&html)?;
+    fs::write(dst, html)?;
+
+    Ok(())
+}

server/src/graphql.rs

@@ -11,12 +11,13 @@ use async_graphql::{
     SimpleObject, Union,
 };
 use log::{error, info, warn};
-use lol_html::{element, errors::RewritingError, rewrite_str, RewriteStrSettings};
 use mailparse::{parse_mail, MailHeader, MailHeaderMap, ParsedMail};
 use memmap::MmapOptions;
 use notmuch::Notmuch;
 use rocket::time::Instant;
 
+use crate::sanitize_html;
+
 pub struct QueryRoot;
 
 /// # Number of seconds since the Epoch
@@ -190,25 +191,6 @@ struct Tag {
     bg_color: String,
     unread: usize,
 }
-fn sanitize_html(html: &str) -> Result<String, RewritingError> {
-    let element_content_handlers = vec![
-        // Open links in new tab
-        element!("a[href]", |el| {
-            el.set_attribute("target", "_blank").unwrap();
-
-            Ok(())
-        }),
-    ];
-
-    Ok(rewrite_str(
-        // TODO(wathiede): replace ammonia with more lol-html rules.
-        &ammonia::clean(&html),
-        RewriteStrSettings {
-            element_content_handlers,
-            ..RewriteStrSettings::default()
-        },
-    )?)
-}
 
 #[Object]
 impl QueryRoot {

server/src/lib.rs

@@ -1,3 +1,215 @@
 pub mod error;
 pub mod graphql;
 pub mod nm;
+
+use css_inline::{CSSInliner, InlineError, InlineOptions};
+use log::error;
+use lol_html::{element, errors::RewritingError, rewrite_str, RewriteStrSettings};
+use maplit::{hashmap, hashset};
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum SanitizeError {
+    #[error("lol-html rewrite error")]
+    RewritingError(#[from] RewritingError),
+    #[error("css inline error")]
+    InlineError(#[from] InlineError),
+}
+
+pub fn sanitize_html(html: &str) -> Result<String, SanitizeError> {
+    let element_content_handlers = vec![
+        // Open links in new tab
+        element!("a[href]", |el| {
+            el.set_attribute("target", "_blank").unwrap();
+
+            Ok(())
+        }),
+        // Only secure image URLs
+        element!("img[src]", |el| {
+            let src = el
+                .get_attribute("src")
+                .expect("src was required")
+                .replace("http:", "https:");
+
+            el.set_attribute("src", &src)?;
+
+            Ok(())
+        }),
+    ];
+
+    let inline_opts = InlineOptions {
+        inline_style_tags: true,
+        keep_style_tags: false,
+        keep_link_tags: false,
+        base_url: None,
+        load_remote_stylesheets: false,
+        extra_css: None,
+        preallocate_node_capacity: 32,
+        ..InlineOptions::default()
+    };
+
+    let inlined_html = match CSSInliner::new(inline_opts).inline(&html) {
+        Ok(inlined_html) => inlined_html,
+        Err(err) => {
+            error!("failed to inline CSS: {err}");
+            html.to_string()
+        }
+    };
+    // Default's don't allow style, but we want to preserve that.
+    let attributes =
+        hashset!["align", "bgcolor", "color", "height", "lang", "title", "width", "style",];
+
+    let tags = hashset![
+        "a",
+        "abbr",
+        "acronym",
+        "area",
+        "article",
+        "aside",
+        "b",
+        "bdi",
+        "bdo",
+        "blockquote",
+        "br",
+        "caption",
+        "center",
+        "cite",
+        "code",
+        "col",
+        "colgroup",
+        "data",
+        "dd",
+        "del",
+        "details",
+        "dfn",
+        "div",
+        "dl",
+        "dt",
+        "em",
+        "figcaption",
+        "figure",
+        "footer",
+        "h1",
+        "h2",
+        "h3",
+        "h4",
+        "h5",
+        "h6",
+        "header",
+        "hgroup",
+        "hr",
+        "i",
+        "img",
+        "ins",
+        "kbd",
+        "kbd",
+        "li",
+        "map",
+        "mark",
+        "nav",
+        "ol",
+        "p",
+        "pre",
+        "q",
+        "rp",
+        "rt",
+        "rtc",
+        "ruby",
+        "s",
+        "samp",
+        "small",
+        "span",
+        "strike",
+        "strong",
+        "sub",
+        "summary",
+        "sup",
+        "table",
+        "tbody",
+        "td",
+        "th",
+        "thead",
+        "time",
+        "title", // wathiede
+        "tr",
+        "tt",
+        "u",
+        "ul",
+        "var",
+        "wbr",
+    ];
+    let tag_attributes = hashmap![
+        "a" => hashset![
+            "href", "hreflang"
+        ],
+        "bdo" => hashset![
+            "dir"
+        ],
+        "blockquote" => hashset![
+            "cite"
+        ],
+        "col" => hashset![
+            "align", "char", "charoff", "span"
+        ],
+        "colgroup" => hashset![
+            "align", "char", "charoff", "span"
+        ],
+        "del" => hashset![
+            "cite", "datetime"
+        ],
+        "hr" => hashset![
+            "align", "size", "width"
+        ],
+        "img" => hashset![
+            "align", "alt", "height", "src", "width"
+        ],
+        "ins" => hashset![
+            "cite", "datetime"
+        ],
+        "ol" => hashset![
+            "start"
+        ],
+        "q" => hashset![
+            "cite"
+        ],
+        "table" => hashset![
+            "align", "border", "cellpadding", "cellspacing", "char", "charoff", "summary",
+        ],
+        "tbody" => hashset![
+            "align", "char", "charoff"
+        ],
+        "td" => hashset![
+            "align", "char", "charoff", "colspan", "headers", "rowspan"
+        ],
+        "tfoot" => hashset![
+            "align", "char", "charoff"
+        ],
+        "th" => hashset![
+            "align", "char", "charoff", "colspan", "headers", "rowspan", "scope"
+        ],
+        "thead" => hashset![
+            "align", "char", "charoff"
+        ],
+        "tr" => hashset![
+            "align", "char", "charoff"
+        ],
+    ];
+
+    let clean_html = ammonia::Builder::default()
+        .tags(tags)
+        .tag_attributes(tag_attributes)
+        .generic_attributes(attributes)
+        .clean(&inlined_html)
+        .to_string();
+    //let clean_html = inlined_html;
+
+    Ok(rewrite_str(
+        // TODO(wathiede): replace ammonia with more lol-html rules.
+        // &ammonia::clean(&html),
+        &clean_html,
+        RewriteStrSettings {
+            element_content_handlers,
+            ..RewriteStrSettings::default()
+        },
+    )?)
+}

web/index.html

@@ -64,7 +64,7 @@ iframe {
   white-space: nowrap;
   text-align: right;
 }
-.footer {
+.lb-footer {
   background-color: #eee;
   color: #222;
   position: fixed; 

web/src/view/mod.rs

@@ -452,7 +452,7 @@ fn view_header(query: &str, refresh_request: &RefreshingState) -> Node<Msg> {
 
 fn view_footer(render_time_ms: u128) -> Node<Msg> {
     footer![
-        C!["footer"],
+        C!["lb-footer"],
         div![
             C!["content", "has-text-right", "is-size-7"],
             format!("Render time {} ms", render_time_ms)