Fix security vulnerabilities: XSS, postMessage origin validation, and…

.editorconfig

@@ -15,3 +15,11 @@ trim_trailing_whitespace = false
 [*.scss]
 indent_size = 2
 indent_style = tab
+
+[tests/mail-renderer/public/**]
+trim_trailing_whitespace = false
+insert_final_newline = unset
+indent_style = unset
+indent_size = unset
+end_of_line = unset
+charset = unset

.gitignore

@@ -26,6 +26,7 @@ tsconfig.tsbuildinfo
 .netlify
 storybook-static
 i18n-js
+translations.pot
 po
 coverage
 lib-cov
@@ -39,6 +40,7 @@ build
 *.code-workspace
 .vscode
 .nyc_output
+test-results
 tests/**/*.png
 !tests/**/*-linux.png
 !tests/mail/**/*.png

.grype.yaml

@@ -24,6 +24,31 @@ ignore:
           name: golang.org/x/crypto
           type: go-module
           version: v0.0.0-20220829220503-c86fa9a7ed90
+    - vulnerability: CVE-2025-68121
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.15.5
+    - vulnerability: CVE-2025-68121
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.18.8
+    - vulnerability: CVE-2025-68121
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.24.5
+    - vulnerability: CVE-2025-22871
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.18.8
+    - vulnerability: CVE-2025-22871
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.15.5
     - vulnerability: CVE-2024-24790
       package:
           name: stdlib
@@ -114,6 +139,21 @@ ignore:
           name: stdlib
           type: go-module
           version: go1.18.8
+    - vulnerability: CVE-2026-27143
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.15.5
+    - vulnerability: CVE-2026-27143
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.18.8
+    - vulnerability: CVE-2026-27143
+      package:
+          name: stdlib
+          type: go-module
+          version: go1.26.1
     ### Npm
     - vulnerability: GHSA-phwq-j96m-2c2q
       package:

.margebot.yml

@@ -16,6 +16,7 @@ fastTrack:
         - djankovic
         - aharwara
         - pchiabre
+        - vthanase
 forbiddenTags:
     - state::Blocked
 ciFailFast: true

.prettierignore

@@ -7,6 +7,7 @@ packages/styles/scss/**/_index.scss
 packages/wasm/**/*
 tests/account/poms/LoginPage/challenge.html
 tests/mail-renderer/tests/**/*.html
+tests/mail-renderer/public/**
 tests/pass/extension/**/*
 tests/pass/hars/**/*
 

.yarnrc.yml

@@ -7,7 +7,7 @@ nodeLinker: node-modules
 plugins:
     - path: .yarn/plugin-postinstall.js
 
-yarnPath: .yarn/releases/yarn-4.12.0.cjs
+yarnPath: .yarn/releases/yarn-4.13.0.cjs
 
 npmPublishRegistry: https://nexus.protontech.ch/repository/web-npm/
 
@@ -17,6 +17,13 @@ npmScopes:
         npmAuthToken: '${CI_JOB_TOKEN:-}'
     proton-meet:
         npmRegistryServer: 'https://nexus.protontech.ch/repository/meet-npm/'
+    proton:
+        npmRegistryServer: 'https://nexus.protontech.ch/repository/foundation-npm/'
+
+npmPreapprovedPackages:
+    - '@proton/*'
+    - '@protontech/*'
+    - '@xmldom/xmldom@0.9.10'
 
 npmAuditIgnoreAdvisories:
     # Ignore advisories for xlsx package. This package is depended on by a third-party library rowsncolumns (docs)
@@ -25,3 +32,5 @@ npmAuditIgnoreAdvisories:
     - 1108111
 
 compressionLevel: mixed
+
+npmMinimalAgeGate: 3d

README.md

@@ -10,6 +10,7 @@ This project is a monorepo hosting the Proton web clients. It includes the web a
 - <img src="./applications/pass/src/favicon.svg" style="vertical-align: middle" height="20" width="20" /> <span style="vertical-align: middle; display: inline-block">Proton Pass</span>
 - <img src="./applications/wallet/src/favicon.svg" style="vertical-align: middle" height="20" width="20" /> <span style="vertical-align: middle; display: inline-block">Proton Wallet</span>
 - <img src="./applications/lumo/src/favicon.svg" style="vertical-align: middle" height="20" width="20" /> <span style="vertical-align: middle; display: inline-block">Proton Lumo</span>
+- <img src="./applications/meet/src/favicon.svg" style="vertical-align: middle" height="20" width="20" /> <span style="vertical-align: middle; display: inline-block">Proton Meet</span>
 
 Technically, this monorepo is based on Yarn & Yarn Workspaces, with unified versioning for all packages inside.
 
@@ -43,6 +44,22 @@ yarn workspace proton-mail start
 
 For additional details on how to interact with the monorepo, see the [yarn docs](https://yarnpkg.com/) for reference.
 
+## How VPN app differs from the rest
+
+VPN is present in both proton.me and protonvpn.com. However, they are served differently. Some parts of VPN are shared, hosted within `@proton/components` or `@proton/shared`, however, the entry points to them are different.
+
+For protonvpn.com, the entry point comes from `applications/vpn-settings` and for account.proton.me/u/{X}/vpn, the entry point is `applications/account`.
+
+Since both domains are separate, we don't share a local SSO between them. Therefore, we need to serve both applications separately:
+
+```shell
+# To serve VPN through vpn-settings
+yarn workspace --port 8050 proton-vpn-settings start
+
+# To serve VPN through account
+yarn start-all --applications "proton-account"
+```
+
 ## How to version an application manually
 
 While being on the `main` branch for a clean release.

applications/account/eslint.config.mjs

@@ -1,3 +1,13 @@
+import { defineConfig } from 'eslint/config';
+
 import config from '@proton/eslint-config-proton/all';
 
-export default config;
+export default defineConfig([
+    config,
+    {
+        rules: {
+            // TODO: Remove this rule once the cycle dependency is fixed
+            'import/no-cycle': 'off',
+        },
+    },
+]);

applications/account/jest.config.js

@@ -3,7 +3,7 @@ module.exports = {
     moduleDirectories: ['<rootDir>/node_modules', 'node_modules'],
     testEnvironment: '@proton/jest-env',
     transformIgnorePatterns: [
-        'node_modules/(?!(@proton/shared|@proton/components|@protontech/telemetry|@protontech/mutex-browser|pmcrypto|openpgp|@openpgp/web-stream-tools|@protontech/bip39|emoji-mart)/)',
+        'node_modules/(?!(@proton/shared|@proton/components|@protontech/telemetry|@protontech/mutex-browser|pmcrypto|openpgp|@openpgp/web-stream-tools|@protontech/bip39|emoji-mart|@preact/signals-core|@scure/base)/)',
     ],
     transform: {
         '^.+\\.(ts|js|mjs)x?$': [

applications/account/jest.setup.js

@@ -7,6 +7,12 @@ import '@proton/testing/lib/mockUnleash';
 // console.error = () => {};
 // console.warn = () => {};
 
+window.ResizeObserver = jest.fn().mockImplementation(() => ({
+    observe: jest.fn(),
+    unobserve: jest.fn(),
+    disconnect: jest.fn(),
+}));
+
 // Do not start crypto worker pool, let the single tests setup/mock the CryptoProxy as needed
 jest.mock('@proton/shared/lib/helpers/setupCryptoWorker', () => ({
     __esModule: true,

applications/account/locales/.locale-state.metadata

@@ -1,4 +1,4 @@
 {
   "project": "fe-account",
-  "locale": "640fe4f4810d886da1f34a82ffaf1dd7f303cfee"
+  "locale": "77c3959201a2b88bcddc7ce7848cd13b2e1d7790"
 }