check security of cid replacements PR

[tomholub]

@tomholub the PR is ready for review 🚀

@seisvelas please evaluate the security of the extractInlineImagesToAttachments() method

Thanks!

Originally posted by @limonte in #3256 (comment)

[seisvelas]

Everything looks perfectly tidy and sanitized just fine to me, I don't see any way this could be used to attack the recipient.

I do have one question about this though, specifically this method:

flowcrypt-browser/extension/chrome/elements/compose-modules/compose-send-btn-module.ts

Lines 183 to 192 in 5008408

	private parseInlineImageSrc = (src: string) => {
	let mimeType;
	let data = '';
	const parts = src.split(/[:;,]/);
	if (parts.length === 4 && parts[0] === 'data' && parts[1].match(/^image\/\w+/) && parts[2] === 'base64') {
	mimeType = parts[1];
	data = parts[3];
	}
	return { mimeType, data };
	}

It seems we assume that the the image src is a data uri. What if there is an image in a PGP/MIME email with src set to an external URL (ala some.site/image.png)? Will this just break?

[limonte]

some.site/image.png

Hey @seisvelas and sorry that it took so long for me to answer your question here. The answer is: yes, it'll just break with unexpected src values of inline images. That's of course not how it should be, thanks for noticing!

The PR is coming.