mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-25 18:47:22 -06:00
bb8fcd006e
* Security: refuse email links that attach or insert a local file Follow-up to #104. A document's mailto: link could ask the email app to attach a file from the user's computer (Evolution, KMail and Claws Mail honour attach=, Evolution and KMail also attachment=) or read one into the body (Claws Mail's insert=). document_url now refuses a mailto: address in which any word starting with attach or insert (any case) is followed by =, wherever it stands and after each layer of percent-decoding. It also refuses text that some email tools decode before reading the address: RFC 2047 encoded words, which KMail decodes across the whole address, and backslash escapes, which xdg-email's echo decodes. The link is refused rather than rewritten: PdfCraft doesn't change what a document asks to open, and the email apps' parsers disagree with one another. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Security: show a link's host as the browser receives it, in punycode Follow-up to #104. The link prompt's host now comes from links::display_host, which reads it with url::Url: the webbrowser crate hands the OS that crate's serialisation, and the web build's browser parses by the same WHATWG standard. International hosts are shown in punycode with a note, a label mixing writing systems (UTS #39 resolved script sets) gets a red warning, numeric hosts such as 3232235777 show as 192.168.1.1, and a host the browser would reject is refused as malformed. The Unicode form isn't repeated in the prompt, so a whole-script lookalike can't read as the real site. url, idna and icu_properties become direct dependencies of pdfcraft-engine; all three were already in the graph. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Security: refuse document addresses the URL parser rejects Follow-up to #104. egui opens links through the webbrowser crate, which parses the address with url::Url and, when that fails, treats it as a local file path and opens file:///<cwd>/<address> in the browser. document_url accepted addresses that don't parse, such as mailto://a^b/x or https://a^b/ (a forbidden host code point), so a document could still get the browser to open a local path. document_url now also requires url::Url to accept the address with the same scheme, which is exactly the parse webbrowser does first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>
46 lines
1.6 KiB
TOML
46 lines
1.6 KiB
TOML
[package]
|
|
name = "pdfcraft-engine"
|
|
description = "PdfCraft engine façade: session, documents, command/tool catalogue"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
pdfcraft-measure = { workspace = true }
|
|
image = { version = "0.25", default-features = false, features = ["jpeg", "tiff"] }
|
|
pdfcraft-render = { workspace = true }
|
|
pdfcraft-cos = { workspace = true }
|
|
pdfcraft-organize = { workspace = true }
|
|
pdfcraft-annot = { workspace = true }
|
|
pdfcraft-forms = { workspace = true }
|
|
pdfcraft-xfa = { workspace = true }
|
|
pdfcraft-edit = { workspace = true }
|
|
pdfcraft-redact = { workspace = true }
|
|
pdfcraft-print = { workspace = true }
|
|
pdfcraft-xfdf = { workspace = true }
|
|
pdfcraft-sign = { workspace = true }
|
|
pdfcraft-optimize = { workspace = true }
|
|
pdfcraft-a11y = { workspace = true }
|
|
pdfcraft-ocr = { workspace = true }
|
|
pdfcraft-js = { workspace = true }
|
|
pdfcraft-compare = { workspace = true }
|
|
pdfcraft-preflight = { workspace = true }
|
|
pdfcraft-export = { workspace = true }
|
|
pdfcraft-fonts = { workspace = true }
|
|
pdfcraft-create = { workspace = true }
|
|
pdfcraft-model = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
png = "0.18"
|
|
# Already in the graph (url and idna through webbrowser, icu_properties through boa): they show
|
|
# the host of a document's link the way the browser reads it (links::display_host).
|
|
url = "2.5"
|
|
idna = "1.1"
|
|
icu_properties = "2.3"
|
|
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
|
|
# Already in the graph through lopdf; used only for the local UTC offset ("today").
|
|
chrono = { version = "0.4", default-features = false, features = ["clock"] }
|