- Shipped
- August 5, 2026 at 1:57 AM UTC
- Author
- kamo
- Commit
- 7e546ee
Mail in the reading pane opens every link in a new tab, which is right for the whole internet and wrong for us. Our notification emails are almost entirely links back into the app, and sending those to a fresh tab throws away the session the member already has and makes them sit through a cold boot to reach a page this tab could render immediately. Same origin is the whole test — byte-equal with the page rendering the email, not "looks like a Kamo domain" and not a suffix match on the org's domain. That is exactly the set of URLs the current session is valid for, which is the entire reason to stay in this tab, and it is un-spoofable by mail: another tenant's host, a lookalike, or userinfo pointing the host elsewhere are all different origins and go to a new tab like any other stranger's link. Routing rather than assigning location: a full document load tears down the React tree and destroys every open tool window along with any unsent draft, which is why this repo has a build gate against hard internal navigation. Modified and middle clicks are left alone — that gesture is the user deliberately asking for a new tab. Listening from the parent works because the sandbox already keeps allow-same-origin for the height measurement while omitting allow-scripts, so nothing from the email itself ever runs; the handler is ours, attached from outside. One trap worth recording, caught by its own test: returning a path rather than a URL is necessary but NOT sufficient. "https://host//evil.test" is genuinely same-origin, and its pathname is "//evil.test" — which the router reads as protocol-relative and follows off-site. An emailed open redirect that passes an origin check. Such a link now falls through to a new tab, where the browser resolves the real, harmless URL, rather than being silently rewritten to somewhere the email did not point.