mirror of
https://github.com/Foundry376/Mailspring.git
synced 2026-10-11 22:50:11 +02:00
Ben GotowandClaude
359fd85a7d
* Harden plugin loading against path traversal and silent RCE - Validate package name against /^[a-z0-9._-]+$/ in Package and reject invalid names during discovery and installPackageFromPath, preventing a malicious package.json#name like "../foo" from causing cpSync to write outside configDir/packages/. - Flip the install trust dialog so Cancel is the default button; Enter no longer approves an untrusted plugin install. - Honor core.disabledPackages for all plugins, not just isOptional ones, so users have a kill switch for any package. * Address PR review: fix seed config regression and cpSync error path - Drop send-and-archive and main-calendar from the dot-mailspring seed disabledPackages list. They are non-optional core features (composer send-action, calendar window) that the previous isOptional() gate was silently letting load despite being listed; with disabledPackages now honored universally, fresh installs would lose both features. - Wrap cpSync + Package construction in a try/catch in installPackageFromPath so failures (existing destination, permission errors, etc.) route through the install callback instead of throwing past it. Best-effort cleanup of any partial copy left behind. * Update package-manager.ts --------- Co-authored-by: Claude <noreply@anthropic.com>
Default Config
These are the default Mailspring configs. This folder on setup is copied to
/Library/Application Support/Mailspring on a Mac and otehr appropriate folders
on Windows and Linux.