Hello, On Wed, Nov 11, 2026, Simon Quigley wrote:
Everything below is also in that Trixie update; I'm not adding anything Trixie doesn't have.
I need to walk that back a bit. This debdiff has three changes that aren't in 5.12.1-3+deb13u3, and I'd like to keep all of them for now. The first is the mail sort list (6c93d6b). In 5.8.0, the sort key gets uppercased before it hits the allowlist. Trixie's list is lowercase (subject, from, date, size, arrival), so something like arrival turns into ARRIVAL, doesn't match, and never gets saved. 6c93d6b is just that list in uppercase. The contact and calendar lists stay lowercase, as in d089c404. The other two are later sanitizer commits. 8813677 gives the @import cleanup its own regex. In Trixie's angular patch, the loop ends up reusing the brace pattern, so the @import replacement throws and the cleanup never finishes. 10dc173 keeps stripping schemes until the string stops changing, rewrites the handlers the filter knows about to data-blocked=, and handles decimal brace entities. For comparison, on 5.8.0-2+deb12u3 "javajavascript:script:" still comes back as "javascript:", and "onerror =alert(1)" survives. Since 6c93d6b is the same one-line change on the 5.12 mail sorter, Trixie probably has the lowercase list problem too. That might be worth a look for the next Trixie update, separately from this one. If you'd rather I trim this back to match Trixie exactly, I'm happy to. Feedback is welcome. Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
