Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ProtonMail/android-mail

              main @ 372655c
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Reflected XSS: 3 prior fixes. Scrutinize any change in this area.

mail-message/presentation/src/main/kotlin/ch/protonmail/android/mailmessage/presentation/ui/MessageBodyWebView.kt: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Stored XSS: Multiple fixes in message body rendering indicate a persistent risk of stored XSS from decrypted email HTML, with sanitization added in different layers (mapper, use case) over time.

Reflected XSS: Pasted content and header fields have been repeatedly patched, showing that multiple entry points (paste events, print header builder) can inject HTML if not sanitized consistently.

Path Traversal: Two separate fixes sanitize file names, indicating that unsanitized attachment names can lead to path traversal in different code paths (sharing and storage).