Skip to content

fix: guard crypto.randomUUID for insecure origins (toast store, message-id, contact uid) #888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rathlinus merged 2 commits into from
Aug 25, 2026
+13 −3
Merged

fix: guard crypto.randomUUID for insecure origins (toast store, message-id, contact uid) #888

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a92c852
fix: generateMessageId crashes on insecure origins (crypto.randomUUID…
texchi2 Aug 22, 2026
5e0efff
fix: toast store crashes on insecure origins (crypto.randomUUID undef…
texchi2 Aug 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions lib/jmap/client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import { generateUUID } from '@/lib/utils';
import type { Email, Mailbox, StateChange, AccountStates, Thread, Identity, EmailAddress, ContactCard, AddressBook, AddressBookRights, VacationResponse, Calendar, CalendarRights, CalendarEvent, CalendarEventFilter, CalendarTask, FileNode, FileNodeFilter, FileNodeRights, Principal, PushSubscription, EmailSubmission, ScheduledEmail, SendEmailResult, SharedAccount } from "./types";
import type { SieveScript, SieveCapabilities } from "./sieve-types";
import type { IJMAPClient, KeywordDiscoveryResult, KeywordInfo, KeywordMigration } from "./client-interface";
Expand Down Expand Up @@ -514,7 +515,11 @@ function stripMessageIdBrackets(id: string): string {
function generateMessageId(fromEmail: string): string {
const at = fromEmail.lastIndexOf('@');
const domain = at > 0 ? fromEmail.slice(at + 1) : 'localhost';
return `${Date.now().toString(36)}.${crypto.randomUUID()}@${domain}`;
// FTM fix (2026-08-22): crypto.randomUUID() only exists in SECURE contexts (https/localhost).
// On a plain-http LAN origin it is undefined, so this line threw AFTER the draft was saved and
// BEFORE EmailSubmission/set — send silently failed with drafts piling up. generateUUID() from
// lib/utils falls back to crypto.getRandomValues, which insecure contexts do provide.
return `${Date.now().toString(36)}.${generateUUID()}@${domain}`;
}

/**
Expand Down Expand Up @@ -4856,7 +4861,7 @@ export class JMAPClient implements IJMAPClient {
"new-contact": {
...contactData,
// Stalwart stores the card without one if omitted (#644)
uid: contactData.uid || `urn:uuid:${crypto.randomUUID()}`,
uid: contactData.uid || `urn:uuid:${generateUUID()}`,
addressBookIds,
}
}
Expand Down
7 changes: 6 additions & 1 deletion stores/toast-store.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import { create } from "zustand";
import { Toast, ToastAction } from "@/components/ui/toast";
import { generateUUID } from "@/lib/utils";

interface ToastStore {
toasts: Toast[];
Expand All @@ -12,7 +13,11 @@ export const useToastStore = create<ToastStore>((set) => ({
toasts: [],

addToast: (toast) => {
const id = crypto.randomUUID();
// FTM fix (2026-08-22): crypto.randomUUID() only exists in SECURE contexts
// (https/localhost). On a plain-http LAN origin it is undefined, so EVERY
// toast crashed -- and took the caller's post-success path down with it
// (calendar save: the success toast threw before the dialog-close ran).
const id = generateUUID();
const newToast: Toast = {
...toast,
id,
Expand Down