Fix security vulnerabilities: XSS, postMessage origin validation, and…#491

Draft

Syedsmaeel wants to merge 4455 commits into

ProtonMail:mainfrom

Syedsmaeel:security-fixes

This pull request is big! We're only showing the most recent 250 commits

Commits on Apr 15, 2026

Disable 2fa using recovery phrase

StraightOuttaCrompton
authored and
MargeBot
committed
Add phrase telemetry

StraightOuttaCrompton
authored and
MargeBot
committed
Merge branch 'CP-11716-unauth-lost-2fa-phrase' into 'main'
MargeBot
committed
DRVWEB: Implement versioning for Index Populators

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-addmissing-table-records' into 'main'
MargeBot
committed

Commits on Apr 16, 2026

Update proton-meet-core to 1.1.6-13

Linquas
authored and
MargeBot
committed
Merge branch 'update-proton-meet-core' into 'main'
MargeBot
committed
i18n(calendar): update translations from crowdin e7d716bd82
L10n bot
committed
i18n(mail): update translations from crowdin 52388525fa
L10n bot
committed
i18n(drive): update translations from crowdin e17811209a
L10n bot
committed
i18n(account): update translations from crowdin 51df79bbc4
L10n bot
committed
i18n(vpn-settings): update translations from crowdin 62c57bffa8
L10n bot
committed
i18n(verify): update translations from crowdin 22a383d63a
L10n bot
committed
i18n(pass): update translations from crowdin 60fd9a767e
L10n bot
committed
i18n(pass-desktop): update translations from crowdin 9a02f35e70
L10n bot
committed
i18n(wallet): update translations from crowdin da25d04ca3
L10n bot
committed
i18n(docs): update translations from crowdin ebe94d13c0
L10n bot
committed
i18n(lumo): update translations from crowdin df2a56e367
L10n bot
committed
i18n(meet): update translations from crowdin 1f15f3aa32
L10n bot
committed
Merge branch 'translations_2026-04-16_050334_b21999fa' into 'main'
MargeBot
committed
DRVWEB: Search errors sentry/comlink hardening :muscle:

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-forward-errors-to-sentry' into 'main'
MargeBot
committed
Add comparison table component

fraser-proton
authored and
MargeBot
committed
Merge branch 'comparison-table-component' into 'main'
MargeBot
committed
Improving Meet recording performance

István Barna
authored and
MargeBot
committed
Merge branch 'MEET-657' into 'main'
MargeBot
committed
Feedback first cancellation flow: different account content

fraser-proton
authored and
MargeBot
committed
Merge branch 'INWEB-883-different-account-content' into 'main'
MargeBot
committed
fix(INDA-675): Fix snap running under wayland/x11 with Electron v40

ElectroNafta
authored and
MargeBot
committed
Merge branch 'fix/INDA-675' into 'main'
MargeBot
committed
Upgrade dompurify to fix vulnerability

Vijayasingam
authored and
MargeBot
committed
Merge branch 'fix-vulnerability' into 'main'
MargeBot
committed
Devices refactor

RayoProton
authored and
MargeBot
committed
Merge branch 'MEET-388-permissions' into 'main'
MargeBot
committed
Combine video quality feedback options and add missing video visibility option

István Barna
authored and
MargeBot
committed
Merge branch 'MEET-979' into 'main'
MargeBot
committed
[VPNBE-1701]-Worked on Flow to Account Page Modification Free VPN Landing Page

Snehal Bodile
authored and
MargeBot
committed
Merge branch 'vpn/task/VPNBE-1701-flow-to-account-page-modification-free-vpn-landing-page' into 'main'
MargeBot
committed
Sheets: Include some more information in update timeline

Aman Harwara
authored and
MargeBot
committed
Merge branch 'sheets-update-timeline' into 'main'
MargeBot
committed
Add .m to attachment allowed file types

Marc Dupont
authored and
MargeBot
committed
Merge branch 'lumo-filetype-m' into 'main'
MargeBot
committed
Verify if codec is really supported by the browser

RayoProton
authored and
MargeBot
committed
Merge branch 'recording-encoder-fix' into 'main'
MargeBot
committed
Optimize background-blur model

Kévin Ta
authored and
MargeBot
committed
Merge branch 'feat/bg-blur-model' into 'main'
MargeBot
committed
Fix: add Workspace Premium plan to drive subscription modal

Jonathan Bosi
authored and
MargeBot
committed
Merge branch 'CP-11744-drive-show-workspace-premium-as-an-upgarde-option-in-select-plan-modal' into 'main'
MargeBot
committed
Add all related content for bug or quality issue modal

fraser-proton
authored and
MargeBot
committed
Merge branch 'INWEB-884-bug-or-quality-content' into 'main'
MargeBot
committed
[LUMO-466] Adding notification panel which can be used for surveys, new announcements, etc.

eamonnmag
authored and
MargeBot
committed
Merge branch 'lumo/lumo-466' into 'main'
MargeBot
committed
P2-2076 Experimentally remove Lumo addon from VPN Plus checkout

Jonathan Bosi
authored and
MargeBot
committed
Merge branch 'P2-2076-remove-lumo-from-vpn-plus-checkout-part-two' into 'main'
MargeBot
committed
[DRVWEB-5316] fix icon and text on folder upload skipped

Stefano Sergio
authored and
MargeBot
committed
Merge branch 'DRVWEB-5316-Fix-icon-and-text-on-folder-upload-skipped' into 'main'
MargeBot
committed
Revert redirecting links functionality added to support migration to new lumo marketing links

Elena Atencio
authored and
MargeBot
committed
Merge branch 'lumo/remove-redirect-marketing-links-logic' into 'main'
MargeBot
committed
[DRVWEB-5269] Move sharing modal to drive package

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'feature/DRVWEB-5269-redo-export-sharing-modal' into 'main'
MargeBot
committed
[DRVWEB-5318] fix column overlap

Stefano Sergio
authored and
MargeBot
committed
Merge branch 'DRVWEB-5318-fix-column-overlap' into 'main'
MargeBot
committed
refactor: replace some more Icon for drive/store folder

nico3333fr
authored and
MargeBot
committed
Merge branch 'refactor-icon-component-drive-store' into 'main'
MargeBot
committed
DRVWEB: Move populator generation to DB

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-support-for-generation-bumping' into 'main'
MargeBot
committed

Commits on Apr 17, 2026

[DRVWEB-5368] Improve header of sharing modal and replace checkbox with toggle

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'feature/DRVWEB-5368-sharing-settings-modal-ux-changes' into 'main'
MargeBot
committed
Split msw updates in renovate

mmso
authored and
MargeBot
committed
Merge branch 'renovate-msw' into 'main'
MargeBot
committed
NOISSUE: Align center 'Sign-in complete' text

Redacted
authored and
MargeBot
committed
Merge branch 'noissue-fix-text-styling' into 'main'
MargeBot
committed
Remove `help` link from new reset password flow

Vijayasingam
authored and
MargeBot
committed
Merge branch 'update-help-link' into 'main'
MargeBot
committed
Use `napi_res` macro for mapping error types

edvincandon
authored and
MargeBot
committed
Cargo clippy on pass-desktop native code

edvincandon
authored and
MargeBot
committed
Add pass-desktop native lint job

edvincandon
authored and
MargeBot
committed
Format authenticator rust tauri code

edvincandon
authored and
MargeBot
committed
Add authenticator lint job in CI

edvincandon
authored and
MargeBot
committed
Fix authenticator windows build

edvincandon
authored and
MargeBot
committed
Merge branch 'IDTEAM-pass-desktop-native-lint' into 'main'
MargeBot
committed
[DRVWEB-5084] Test if item can be re-shared if user has admin rights

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'feature/DRVWEB-5084-admin-sharing-unit-tests' into 'main'
MargeBot
committed
[DRVWEB-5367] fix sharable device root

Stefano Sergio
authored and
MargeBot
committed
Merge branch 'DRVWEB-5367-fix-sharable-device-root' into 'main'
MargeBot
committed
New cherry diffing script
edvincandon
committed
Add `cherry` to packages/pass scripts
edvincandon
committed
Drop legacy diff script
edvincandon
committed
Merge branch 'IDTEAM-cherry-script' into 'main'
MargeBot
committed
Secure against clickjacking TopLayerManager evasion attacks

edvincandon
authored and
MargeBot
committed
Unit-test TopLayerManager guard poisoning

edvincandon
authored and
MargeBot
committed
Merge branch 'IDTEAM-5932-click-jacking-evasion' into 'main'
MargeBot
committed
DRVWEB: More reliable search querying v2

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-improve-search-query-one-more-time' into 'main'
MargeBot
committed
Updated custom logo to be used in the new cancellation flow

fraser-proton
authored and
MargeBot
committed
Merge branch 'custom-logo-changes' into 'main'
MargeBot
committed
[DRVWEB-5084] Test sharing permissions in folder browser

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'feature/DRVWEB-5084-admin-sharing-folder-view-test' into 'main'
MargeBot
committed
VPNBE-1920: Change 'streaming' for 'speed'

Redacted
authored and
MargeBot
committed
Merge branch 'VPNBE-1920-change-streaming-for-speed' into 'main'
MargeBot
committed
[DRVWEB-5084] Test user name tools of sharing modal

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'feature/DRVWEB-5084-test-name-generation' into 'main'
MargeBot
committed
[VPNB2B-71] BUG solved: when a resolver updates a `to` property, the prefix is not preserved

asieraduriz
authored and
MargeBot
committed
Merge branch 'VPNB2B-71--bug--update-to-doesnt-preserve-prefix' into 'main'
MargeBot
committed
Fix background gradient rendering differences in Firefox

István Barna
authored and
MargeBot
committed
Merge branch 'MEET-938' into 'main'
MargeBot
committed
[DRVWEB-5084] Add test cases to DirectSharingMemberMenu tests

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'feature/DRVWEB-5084-improve-sharing-member-menu-tests' into 'main'
MargeBot
committed
Add new reset password FF redirection to other pages

Vijayasingam
authored and
MargeBot
committed
Merge branch 'add-reset-pwd-ff-check' into 'main'
MargeBot
committed
Display VAT validation error in PayButton

lkpch
authored and
MargeBot
committed
Merge branch 'P2-2069-improve-ux-for-icnomplete-billing-address' into 'main'
MargeBot
committed
Removing more re-exports from the payments barrel

lkpch
authored and
MargeBot
committed
Merge branch 'remove-payment-barrel' into 'main'
MargeBot
committed
DRVWEB-5370: Increase search engine token length from 20 to 255

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-5370-fix-missing-text-indexing' into 'main'
MargeBot
committed
Drive b2b plans will not be supported by the new cancellation flow

fraser-proton
authored and
MargeBot
committed
Merge branch 'update-eligibility-for-cancellation-flow' into 'main'
MargeBot
committed
Tech: Improve logic and UI separation in checkout component

Jonathan Bosi
authored and
MargeBot
committed
Merge branch 'ref/payments' into 'main'
MargeBot
committed
Fix: hide vpn upsellToggle during promo

Jonathan Bosi
authored and
MargeBot
committed
Merge branch 'P2-2095-hide-the-12-m-toggle-on-the-signup-page-when-vpnpass-2023-plan-is-used' into 'main'
MargeBot
committed
Add storycard component for cancellation flow

fraser-proton
authored and
MargeBot
committed
Merge branch 'storycard-component' into 'main'
MargeBot
committed
Update reset password hook to retain variant

Vijayasingam
authored and
MargeBot
committed
Merge branch 'fix-reset-password-variant-param' into 'main'
MargeBot
committed
Fix URL for Lumo Enterprise card

lkpch
authored and
MargeBot
committed
Merge branch 'P2-2025-change-lumo-trial-url' into 'main'
MargeBot
committed

Commits on Apr 19, 2026

Idteam 5855 alphabetic order items pass monitor

nguyenkims
authored and
MargeBot
committed
Merge branch 'IDTEAM-5855-alphabetic-order-items-pass-monitor' into 'main'
MargeBot
committed

Commits on Apr 20, 2026

add the admin panel to extension humberger menu

nguyenkims
authored and
MargeBot
committed
Merge branch 'IDTEAM-6026-admin-panel-link-extension-menu' into 'main'
MargeBot
committed
DRVWEB: Unify all searchDB connections on main thread

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-searchdb-cleanup-my-precious' into 'main'
MargeBot
committed
Added two new icons to the icons package

fraser-proton
authored and
MargeBot
committed
Merge branch 'added-diamond-and-signature-icons' into 'main'
MargeBot
committed
Remove `back` button from reset password mnemonic flow

Vijayasingam
authored and
MargeBot
committed
Merge branch 'reset-pwd-remove-back' into 'main'
MargeBot
committed
Upgrade @xmldom/xmldom

Vijayasingam
authored and
MargeBot
committed
Merge branch 'fix-vulnerability' into 'main'
MargeBot
committed
[IDTEAM-4633] Improved desktop unlock error management

Swiip
authored and
MargeBot
committed
Merge branch 'IDTEAM-4633-desktop-unlock-qa-findings' into 'main'
MargeBot
committed
Allow changing password without user keys

mmso
authored and
MargeBot
committed
Merge branch 'pw-keys' into 'main'
MargeBot
committed
AdminRole(Account): add onboarding flow Member Page

Thong-Nguyen The
authored and
MargeBot
committed
Merge branch 'adminrole/user-page/03-add-onboarding-flow-member-page' into 'main'
MargeBot
committed
DRVWEB: Fix trash view sorting by deleted date column [DRVCST-438]

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVCST-438-fix-sorting-in-trash-section-view' into 'main'
MargeBot
committed
Ignore stdlib go vulnerabilities

Vijayasingam
authored and
MargeBot
committed
Merge branch 'ignore-go-vulnerabilities' into 'main'
MargeBot
committed
Message in spam sometimes trigger a notification

Germain Souquet
authored and
MargeBot
committed
Merge branch 'INWEB-920-message-in-spam-triggers-a-notification' into 'main'
MargeBot
committed
Remove name from uploadLog

HeadFox
authored and
MargeBot
committed
Merge branch 'drive/remove-file-name-sentry' into 'main'
MargeBot
committed
[VPNB2B-35] Add composable sidebar into the Design System

asieraduriz
authored and
MargeBot
committed
Merge branch 'VPNB2B-35--move-sidebar-to-ds' into 'main'
MargeBot
committed
fix: Fix CC/BCC display when scroll is there

nico3333fr
authored and
MargeBot
committed
Merge branch 'INWEB-610-cc-bcc-scroll' into 'main'
MargeBot
committed
Improve Sentry for payments

lkpch
authored and
MargeBot
committed
Merge branch 'P2-2107-improve-sentry-payments' into 'main'
MargeBot
committed
Verify app didn't show toasts at all when not in iframe

Jan Sukenik
authored and
MargeBot
committed
Merge branch 'feature/verify-no-iframe-toasts' into 'main'
MargeBot
committed

Commits on Apr 21, 2026

i18n(calendar): update translations from crowdin fe9eb998de
L10n bot
committed
i18n(mail): update translations from crowdin 2e7475aff5
L10n bot
committed
i18n(mail-desktop): update translations from crowdin ed1b0f7869
L10n bot
committed
i18n(drive): update translations from crowdin 35da2cbd75
L10n bot
committed
i18n(account): update translations from crowdin 77c3959201
L10n bot
committed
i18n(vpn-settings): update translations from crowdin b2d9a06c3b
L10n bot
committed
i18n(verify): update translations from crowdin 34bf9b1878
L10n bot
committed
i18n(pass): update translations from crowdin 1b6d9eedc7
L10n bot
committed
i18n(pass-web): update translations from crowdin 84acf404db
L10n bot
committed
i18n(pass-desktop): update translations from crowdin 14e289609a
L10n bot
committed
i18n(wallet): update translations from crowdin 9614b1170f
L10n bot
committed
i18n(docs): update translations from crowdin f3bdbab20b
L10n bot
committed
i18n(docs-editor): update translations from crowdin 7dfa2c83f2
L10n bot
committed
i18n(lumo): update translations from crowdin 412069419e
L10n bot
committed
i18n(authenticator-desktop): update translations from crowdin ef04d24277
L10n bot
committed
i18n(meet): update translations from crowdin 655afb217a
L10n bot
committed
Merge branch 'translations_2026-04-21_050334_78505f6c' into 'main'
MargeBot
committed
Added different provider content

fraser-proton
authored and
MargeBot
committed
Merge branch 'INWEB-886-switching-provider-content' into 'main'
MargeBot
committed
NOISSUE: Fix correct acknowledge of isBusiness user

Redacted
authored and
MargeBot
committed
Merge branch 'noissue-fix-acknoledgement-is-business' into 'main'
MargeBot
committed
Prevent concurrent referral spotlight feature PUTs

Raphael Rychetsky
authored and
MargeBot
committed
Merge branch 'referral-feature-code-fix' into 'main'
MargeBot
committed
VPNPLG-58: Add payload and telemetry when forking the session

Redacted
authored and
MargeBot
committed
Merge branch 'VPNPLG-58-add-telemetry-when-forking-session' into 'main'
MargeBot
committed
fix: fix icon alignment in cancellation flow

nico3333fr
authored and
MargeBot
committed
Merge branch 'fix-icon-alignment-cancel-flow' into 'main'
MargeBot
committed
Add offer card UI components

fraser-proton
authored and
MargeBot
committed
Merge branch 'offer-UI-components' into 'main'
MargeBot
committed
added temporary need content and config

fraser-proton
authored and
MargeBot
committed
Merge branch 'INWEB-887-temporary-need-content' into 'main'
MargeBot
committed
feat: workspace premium cancelation flow

Yang Lin
authored and
MargeBot
committed
Merge branch 'feat/workspace-premium-cancelation' into 'main'
MargeBot
committed
Add news subscription for Meet

Kévin Ta
authored and
MargeBot
committed
Merge branch 'feat/meet-newsletter' into 'main'
MargeBot
committed
use the same setting menu for extension as for web

nguyenkims
authored and
MargeBot
committed
Merge branch 'IDTEAM-5749-same-menu-for-extension' into 'main'
MargeBot
committed
INWEB-867: Add common setup for Slack API in the CI

Paolo Chiabrera
authored and
MargeBot
committed
Merge branch 'INWEB-867/setup' into 'main'
MargeBot
committed
Add new permissions modals and stop requesting permissions automatically

RayoProton
authored and
MargeBot
committed
Merge branch 'no-permissions-modal' into 'main'
MargeBot
committed
DRVWEB: Search blobs encryption/decryption

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'search-encryption' into 'main'
MargeBot
committed
Add telemetry for sharing

D-Bao
authored and
MargeBot
committed
Merge branch 'IDTEAM-5613-sharing-telemetry' into 'main'
MargeBot
committed
Limit sharing settings visibility only to admins on parent share

Maciej Lenartowicz
authored and
MargeBot
committed
Merge branch 'fix/drive-admin-sharing-settings-visibility' into 'main'
MargeBot
committed
[DRVWEB-4974] Album listing sdk

HeadFox
authored and
MargeBot
committed
Merge branch 'DRVWEB-4974-album-listing-sdk' into 'main'
MargeBot
committed
Enable telemetry for Meet

Kévin Ta
authored and
MargeBot
committed
Merge branch 'feat/meet-telemetry' into 'main'
MargeBot
committed
Allow expanding message when clicking on recipient name or address

LeGrosSancho
authored and
MargeBot
committed
Merge branch 'INBWEB-924-allow-expanding-message-when-clicking-on-recipient' into 'main'
MargeBot
committed
[DRVWEB-5391] fix signature issue on public download

Stefano Sergio
authored and
MargeBot
committed
Merge branch 'DRVWEB-5391-fix-signatureissue-on-public-download' into 'main'
MargeBot
committed
Feedback first cancellation offer logic and content

fraser-proton
authored and
MargeBot
committed
Merge branch 'INWEB-885-payment-logic-and-content' into 'main'
MargeBot
committed

Commits on Apr 22, 2026

AdminRoles(Account): Implement API call to get roles for MemberID

Thong-Nguyen The
authored and
MargeBot
committed
Merge branch 'adminrole/user-page/02-2-fetch-member-role' into 'main'
MargeBot
committed
Add debug mail store button and modal

LeGrosSancho
authored and
MargeBot
committed
Merge branch 'P3-295-add-store-debug-mode' into 'main'
MargeBot
committed
Add unauth lost 2fa e2e tests

StraightOuttaCrompton
authored and
MargeBot
committed
Merge branch 'worktree-CP-11716-unauth-lost-2fa-tests' into 'main'
MargeBot
committed
change "pass unlimited" to "proton unlimited"

nguyenkims
authored and
MargeBot
committed
Merge branch 'fix-typo-pass-onboarding' into 'main'
MargeBot
committed
Added 1domain support for vpnbiz2023

lkpch
authored and
MargeBot
committed
Merge branch 'P2-2113-add-1domain-vpnbiz2023' into 'main'
MargeBot
committed
Report block verification to erroring users

horejsek
authored and
MargeBot
committed
Merge branch 'drive/fix-sdk-metrics' into 'main'
MargeBot
committed
Attempt to fix drawer apps that cannot be closed

LeGrosSancho
authored and
MargeBot
committed
Merge branch 'use-parent-app-when-resuming-session-failed' into 'main'
MargeBot
committed
Avoid layout shift when typing in empty composer

Germain Souquet
authored and
MargeBot
committed
Merge branch 'fix/lumo-layout-shift' into 'main'
MargeBot
committed
Tech: add useSubscriptionCheck hook

Jonathan Bosi
authored and
MargeBot
committed
Merge branch 'tech/extract-useSubscriptionCheck-hook' into 'main'
MargeBot
committed
Fix recovery issue with photos

HeadFox
authored and
MargeBot
committed
Merge branch 'drive/fix-photos-recovery' into 'main'
MargeBot
committed
Fix bad org or group name causing issues

pedroamaroproton
authored and
MargeBot
committed
Merge branch 'fix-bad-org-group-name' into 'main'
MargeBot
committed
Final polishes and orchestrator component for cancellation flow

fraser-proton
authored and
MargeBot
committed
Merge branch 'feedback-first-cancellation-flow' into 'main'
MargeBot
committed
MEET-279: participants role, share screen slice and other UIs fixes

RayoProton
authored and
MargeBot
committed
Merge branch 'roles-and-ui' into 'main'
MargeBot
committed
DRVWEB-5359: Include trashed items in search index (without exposing them to search queries)

Vincent Renaudin
authored and
MargeBot
committed
Merge branch 'DRVWEB-include-trashed-items-in-index' into 'main'
MargeBot
committed
[IDTEAM-5924] Remove cycle param in pass signup, keep the cycle page

Swiip
authored and
MargeBot
committed
Merge branch 'IDTEAM-5924-remove-cycle-param' into 'main'
MargeBot
committed
Fix security vulnerabilities: XSS, postMessage origin validation, and insecure links
Gemini CLI Agent
committed