[rpms/evolution] f43: Resolves: #2531477 (CVE-2026-88859 Validate clickable preview elements)

[rpms/evolution] f43: Resolves: #2531477 (CVE-2026-88859 Validate clickable preview elements)

[Milan Crha]

A new commit has been pushed.

Repo   : rpms/evolution
Branch : f43
Commit : 8ae56355757eba0adce06aa7799b1e0a7a19a70f
Author : Milan Crha <mcrha@redhat.com>
Date   : 2026-09-10T17:58:56+02:00
Stats  : +281/-2 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/evolution/c/8ae56355757eba0adce06aa7799b1e0a7a19a70f?branch=f43

Log:
Resolves: #2531477 (CVE-2026-88859 Validate clickable preview elements)

---
diff --git a/0001-CVE-2026-88859-validate-clickable-preview-elements.patch b/0001-CVE-2026-88859-validate-clickable-preview-elements.patch
new file mode 100644
index 0000000..596d356
--- /dev/null
+++ b/0001-CVE-2026-88859-validate-clickable-preview-elements.patch
@@ -0,0 +1,275 @@
+diff -up evolution-3.60.2/data/webkit/e-web-view.js.1 evolution-3.60.2/data/webkit/e-web-view.js
+--- evolution-3.60.2/data/webkit/e-web-view.js.1	2026-05-22 05:58:26.000000000 +0200
++++ evolution-3.60.2/data/webkit/e-web-view.js	2026-09-10 17:41:31.627767180 +0200
+@@ -24,6 +24,7 @@ var Evo = {
+ 	blockquoteStyle : "margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex",
+ 	magicSpacebarState: -1,
+ 	markCitationColor : null,
++	pageToken : null,
+ 	plugins : null
+ };
+ 
+@@ -232,6 +233,11 @@ Evo.SetElementAttribute = function(ifram
+ 	}
+ }
+ 
++Evo.HasValidToken = function(elem)
++{
++	return !!Evo.pageToken && elem.getAttribute("evo-token") === Evo.pageToken;
++}
++
+ Evo.createStyleSheet = function(doc, style_sheet_id, content)
+ {
+ 	var node;
+@@ -1135,6 +1141,9 @@ Evo.mailDisplayVCardModeButtonClicked =
+ 	if (!elem || !elem.parentElement)
+ 		return;
+ 
++	if (!Evo.HasValidToken(elem))
++		return;
++
+ 	var normal_btn = null, compact_btn = null, iframe_elem = null, child;
+ 
+ 	for (child = elem.parentElement.firstElementChild; child; child = child.nextElementSibling) {
+@@ -1342,9 +1351,10 @@ Evo.mailDisplaySizeChanged = function(en
+ 	window.requestAnimationFrame(Evo.mailDisplayHandleSizeEntries);
+ }
+ 
+-Evo.MailDisplayBindDOM = function(iframe_id, markCitationColor)
++Evo.MailDisplayBindDOM = function(iframe_id, markCitationColor, pageToken)
+ {
+ 	Evo.markCitationColor = markCitationColor != "" ? markCitationColor : null;
++	Evo.pageToken = pageToken != "" ? pageToken : null;
+ 	if (!Evo.mailDisplayResizeObserver) {
+ 		Evo.mailDisplayResizeObserver = new ResizeObserver(Evo.mailDisplaySizeChanged);
+ 		Evo.mailDisplayResizeObserver.expectChange = 0;
+@@ -1434,7 +1444,7 @@ Evo.MailDisplayBindDOM = function(iframe
+ 
+ 			elem = doc.getElementById("__evo-contact-photo");
+ 
+-			if (elem && elem.hasAttribute("data-mailaddr")) {
++			if (elem && elem.hasAttribute("data-mailaddr") && Evo.HasValidToken(elem)) {
+ 				var mail_addr;
+ 
+ 				mail_addr = elem.getAttribute("data-mailaddr");
+@@ -1938,13 +1948,13 @@ EvoItip.FlipAlternativeHTMLPart = functi
+ 		elem.hidden = !elem.hidden;
+ 	}
+ 	elem = Evo.FindElement(iframe_id, img_id);
+-	if (elem) {
++	if (elem && Evo.HasValidToken(elem)) {
+ 		var tmp = elem.src;
+ 		elem.src = elem.getAttribute("othersrc");
+ 		elem.setAttribute("othersrc", tmp);
+ 	}
+ 	elem = Evo.FindElement(iframe_id, img_id + "-dark");
+-	if (elem) {
++	if (elem && Evo.HasValidToken(elem)) {
+ 		var tmp = elem.src;
+ 		elem.src = elem.getAttribute("othersrc");
+ 		elem.setAttribute("othersrc", tmp);
+diff -up evolution-3.60.2/docs/evolution.1 evolution-3.60.2/docs/evolution
+diff -up evolution-3.60.2/src/em-format/e-mail-formatter.c.1 evolution-3.60.2/src/em-format/e-mail-formatter.c
+--- evolution-3.60.2/src/em-format/e-mail-formatter.c.1	2026-05-22 05:58:26.000000000 +0200
++++ evolution-3.60.2/src/em-format/e-mail-formatter.c	2026-09-10 17:42:26.365292841 +0200
+@@ -23,6 +23,7 @@
+ 
+ #include <gdk/gdk.h>
+ #include <libebackend/libebackend.h>
++#include <camel/camel.h>
+ 
+ #include <e-util/e-util.h>
+ #include <shell/e-shell.h>
+@@ -49,6 +50,7 @@ struct _EMailFormatterPrivate {
+ 
+ 	gchar *charset;
+ 	gchar *default_charset;
++	const gchar *page_token; /* in camel string pool */
+ 
+ 	GdkRGBA colors[E_MAIL_FORMATTER_NUM_COLOR_TYPES];
+ };
+@@ -371,6 +373,7 @@ e_mail_formatter_finalize (GObject *obje
+ 
+ 	g_free (self->priv->charset);
+ 	g_free (self->priv->default_charset);
++	g_clear_pointer (&self->priv->page_token, camel_pstring_free);
+ 
+ 	g_mutex_clear (&self->priv->property_lock);
+ 
+@@ -1517,3 +1520,47 @@ e_mail_formatter_set_default_charset (EM
+ 	g_object_notify (G_OBJECT (formatter), "default-charset");
+ }
+ 
++const gchar * /* (transfer full) use camel_pstring_free() to unref/free it */
++e_mail_formatter_ensure_page_token (EMailFormatter *formatter)
++{
++	const gchar *page_token;
++
++	g_return_val_if_fail (E_IS_MAIL_FORMATTER (formatter), NULL);
++
++	g_mutex_lock (&formatter->priv->property_lock);
++
++	if (!formatter->priv->page_token)
++		formatter->priv->page_token = camel_pstring_add (e_util_generate_uid (), TRUE);
++
++	page_token = camel_pstring_strdup (formatter->priv->page_token);
++
++	g_mutex_unlock (&formatter->priv->property_lock);
++
++	return page_token;
++}
++
++const gchar * /* (transfer full) use camel_pstring_free() to unref/free it */
++e_mail_formatter_dup_page_token (EMailFormatter *formatter)
++{
++	const gchar *result;
++
++	g_return_val_if_fail (E_IS_MAIL_FORMATTER (formatter), NULL);
++
++	g_mutex_lock (&formatter->priv->property_lock);
++	result = camel_pstring_strdup (formatter->priv->page_token);
++	g_mutex_unlock (&formatter->priv->property_lock);
++
++	return result;
++}
++
++void
++e_mail_formatter_reset_page_token (EMailFormatter *formatter)
++{
++	g_return_if_fail (E_IS_MAIL_FORMATTER (formatter));
++
++	g_mutex_lock (&formatter->priv->property_lock);
++
++	g_clear_pointer (&formatter->priv->page_token, camel_pstring_free);
++
++	g_mutex_unlock (&formatter->priv->property_lock);
++}
+diff -up evolution-3.60.2/src/em-format/e-mail-formatter.h.1 evolution-3.60.2/src/em-format/e-mail-formatter.h
+--- evolution-3.60.2/src/em-format/e-mail-formatter.h.1	2026-05-22 05:58:26.000000000 +0200
++++ evolution-3.60.2/src/em-format/e-mail-formatter.h	2026-09-10 17:41:31.628314925 +0200
+@@ -188,6 +188,12 @@ void		e_mail_formatter_set_default_chars
+ 						(EMailFormatter *formatter,
+ 						 const gchar *charset);
+ 
++const gchar *	e_mail_formatter_ensure_page_token
++						(EMailFormatter *formatter);
++const gchar *	e_mail_formatter_dup_page_token	(EMailFormatter *formatter);
++void		e_mail_formatter_reset_page_token
++						(EMailFormatter *formatter);
++
+ G_END_DECLS
+ 
+ #endif /* E_MAIL_FORMATTER_H_ */
+diff -up evolution-3.60.2/src/em-format/e-mail-formatter-headers.c.1 evolution-3.60.2/src/em-format/e-mail-formatter-headers.c
+--- evolution-3.60.2/src/em-format/e-mail-formatter-headers.c.1	2026-05-22 05:58:26.000000000 +0200
++++ evolution-3.60.2/src/em-format/e-mail-formatter-headers.c	2026-09-10 17:41:31.627978613 +0200
+@@ -476,18 +476,21 @@ format_full_headers (EMailFormatter *for
+ 	/* Prefer contact photos over archaic "Face" headers. */
+ 	if (show_sender_photo && photo_name != NULL) {
+ 		gchar *escaped_name;
++		const gchar *page_token;
+ 
+ 		escaped_name = g_uri_escape_string (photo_name, NULL, FALSE);
++		page_token = e_mail_formatter_ensure_page_token (formatter);
+ 		g_string_append (
+ 			buffer,
+ 			"<td align=\"right\" valign=\"top\">");
+ 		g_string_append_printf (
+ 			buffer,
+ 			"<img src=\"mail://contact-photo?mailaddr=\" "
+-			"data-mailaddr=\"%s\" id=\"__evo-contact-photo\"/>",
+-			escaped_name);
++			"data-mailaddr=\"%s\" evo-token=\"%s\" id=\"__evo-contact-photo\"/>",
++			escaped_name, page_token);
+ 		g_string_append (buffer, "</td>");
+ 
++		g_clear_pointer (&page_token, camel_pstring_free);
+ 		g_free (escaped_name);
+ 
+ 	} else if (!is_rfc822_headers && face_header_value != NULL) {
+diff -up evolution-3.60.2/src/mail/e-mail-display.c.1 evolution-3.60.2/src/mail/e-mail-display.c
+--- evolution-3.60.2/src/mail/e-mail-display.c.1	2026-05-22 05:58:26.000000000 +0200
++++ evolution-3.60.2/src/mail/e-mail-display.c	2026-09-10 17:41:31.628492964 +0200
+@@ -1356,6 +1356,7 @@ mail_display_load_changed_cb (WebKitWebV
+ 		e_attachment_bar_clear_possible_attachments (E_ATTACHMENT_BAR (display->priv->attachment_view));
+ 		g_hash_table_remove_all (display->priv->cid_attachments);
+ 		display->priv->loaded = FALSE;
++		e_mail_formatter_reset_page_token (display->priv->formatter);
+ 	} else if (load_event == WEBKIT_LOAD_FINISHED) {
+ 		display->priv->loaded = TRUE;
+ 		mail_display_update_remote_content_buttons (display);
+@@ -1370,6 +1371,7 @@ mail_display_content_loaded_cb (EWebView
+ 	EMailDisplay *mail_display;
+ 	GList *attachments, *link;
+ 	gchar *citation_color = NULL;
++	const gchar *page_token;
+ 
+ 	g_return_if_fail (E_IS_MAIL_DISPLAY (web_view));
+ 
+@@ -1424,9 +1426,12 @@ mail_display_content_loaded_cb (EWebView
+ 		}
+ 	}
+ 
++	page_token = e_mail_formatter_dup_page_token (mail_display->priv->formatter);
++
+ 	e_web_view_jsc_run_script (WEBKIT_WEB_VIEW (web_view), e_web_view_get_cancellable (web_view),
+-		"Evo.MailDisplayBindDOM(%s, %s);", iframe_id, citation_color);
++		"Evo.MailDisplayBindDOM(%s, %s, %s);", iframe_id, citation_color, page_token);
+ 
++	g_clear_pointer (&page_token, camel_pstring_free);
+ 	g_free (citation_color);
+ 
+ 	if (mail_display->priv->part_list) {
+diff -up evolution-3.60.2/src/modules/vcard-inline/e-mail-formatter-vcard.c.1 evolution-3.60.2/src/modules/vcard-inline/e-mail-formatter-vcard.c
+--- evolution-3.60.2/src/modules/vcard-inline/e-mail-formatter-vcard.c.1	2026-05-22 05:58:26.000000000 +0200
++++ evolution-3.60.2/src/modules/vcard-inline/e-mail-formatter-vcard.c	2026-09-10 17:41:31.628684214 +0200
+@@ -112,6 +112,7 @@ mail_formatter_vcard_format (EMailFormat
+ 		const gchar *info = NULL;
+ 		gchar *access_key = NULL;
+ 		gchar *html_label;
++		const gchar *page_token;
+ 
+ 		length = g_slist_length ((GSList *) contacts);
+ 
+@@ -119,6 +120,7 @@ mail_formatter_vcard_format (EMailFormat
+ 		message_uid = e_mail_part_list_get_message_uid (context->part_list);
+ 		default_charset = e_mail_formatter_get_default_charset (formatter);
+ 		charset = e_mail_formatter_get_charset (formatter);
++		page_token = e_mail_formatter_ensure_page_token (formatter);
+ 
+ 		if (!default_charset)
+ 			default_charset = "";
+@@ -159,10 +161,11 @@ mail_formatter_vcard_format (EMailFormat
+ 				"class=\"org-gnome-vcard-display-mode-button\" "
+ 				"value=\"%d\" "
+ 				"evo-iframe-uri=\"%s\" "
++				"evo-token=\"%s\" "
+ 				"style=\"margin-left: 0px\""
+ 				"accesskey=\"%s\">%s</button>",
+ 			e_mail_part_get_id (part),
+-			EAB_CONTACT_DISPLAY_RENDER_NORMAL, button_iframe_uri, access_key,
++			EAB_CONTACT_DISPLAY_RENDER_NORMAL, button_iframe_uri, page_token, access_key,
+ 			html_label);
+ 		g_output_stream_write_all (
+ 			stream, str, strlen (str), NULL, cancellable, NULL);
+@@ -189,10 +192,11 @@ mail_formatter_vcard_format (EMailFormat
+ 				"class=\"org-gnome-vcard-display-mode-button\" "
+ 				"value=\"%d\" "
+ 				"evo-iframe-uri=\"%s\" "
++				"evo-token=\"%s\" "
+ 				"style=\"margin-left: 0px\""
+ 				"accesskey=\"%s\" hidden>%s</button>",
+ 			e_mail_part_get_id (part),
+-			EAB_CONTACT_DISPLAY_RENDER_COMPACT, button_iframe_uri, access_key,
++			EAB_CONTACT_DISPLAY_RENDER_COMPACT, button_iframe_uri, page_token, access_key,
+ 			html_label);
+ 		g_output_stream_write_all (
+ 			stream, str, strlen (str), NULL, cancellable, NULL);
+@@ -200,6 +204,7 @@ mail_formatter_vcard_format (EMailFormat
+ 		g_free (html_label);
+ 		g_free (button_iframe_uri);
+ 		g_clear_pointer (&access_key, g_free);
++		g_clear_pointer (&page_token, camel_pstring_free);
+ 
+ 		html_label = e_mail_formatter_parse_html_mnemonics (
+ 				_("Save _To Addressbook"), &access_key);

diff --git a/evolution.spec b/evolution.spec
index 18f0b79..4d7b094 100644
--- a/evolution.spec
+++ b/evolution.spec
@@ -44,7 +44,7 @@
 
 Name: evolution
 Version: 3.58.3
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: Mail and calendar client for GNOME
 License: GPL-2.0-or-later AND GFDL-1.3-or-later
 URL: https://gitlab.gnome.org/GNOME/evolution/-/wikis/home
@@ -55,6 +55,10 @@ Source2: flatpak-evolution-wrapper.sh.in
 # 0-99: General patches
 # enable corresponding autopatch below to make them applied
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=2531477
+# https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388
+Patch01: 0001-CVE-2026-88859-validate-clickable-preview-elements.patch
+
 # 100-199: Flatpak-specific patches
 # https://gitlab.gnome.org/GNOME/evolution-data-server/-/merge_requests/144
 Patch100: configurable-dbus-prefix.patch
@@ -250,7 +254,7 @@ the functionality of the installed %{name} package.
 %autosetup -p1 -S gendiff -N
 
 # General patches
-# %%autopatch -p1 -m 0 -M 99
+%autopatch -p1 -m 0 -M 99
 
 # Flatpak-specific patches
 %if 0%{?flatpak}