[Bug]: PDF/image preview triggers silent download with UUID filename

[dealerweb]

Description

When opening the preview modal for a PDF (or image) attachment, Chrome/Edge silently download the file with the blob's UUID as filename (no extension) instead of rendering it inline. Affects both desktop and Android. Root cause is twofold: Stalwart's /download endpoint can return Content-Type: application/octet-stream even when the attachment declared application/pdf, so the blob URL serves with the wrong MIME and falls back to download. Additionally, is historically unreliable for inline PDF rendering across Chromium browsers — <iframe src> is far more consistent.

Fix: dealerweb/bulwark-webmail@3bdb6ed

Steps to Reproduce

1. Send yourself an email with a PDF attachment from any common mail client (Outlook, Apple Mail, Thunderbird).
2. Settings → set "Default attachment action" to "Preview".
3. Open the email, click the eye/preview icon on the PDF.
4. Observe the browser's download manager.

Expected Behavior

The PDF renders inline in the preview modal.

Actual Behavior

The modal opens briefly (or appears empty), and the browser silently downloads the blob to disk with the blob UUID as filename (e.g. e2ac209d-757c-48b8-91b8-eec66b0f52e1) and no file extension. The user has no way to identify what was downloaded.

Bulwark Version

1.7.1

Stalwart Mail Server Version

0.16.6

Browser

No response

Operating System

None

Screenshots / Screen Recording

No response

Relevant Logs or Error Output

Additional Context

No response

[dealerweb]

I've fixed some more bugs with Claude. You can check them out here:

dealerweb/bulwark-webmail@main...combined

How would you like me to handle this? Should I create a separate bug report for each one (if it's worth it), or would you like to take a look and pick out the ones you think are worth addressing?

[rathlinus]

did you check against the beta container?

[dealerweb]

As for this bug and the fix I linked to: Yes, I just did that. There isn't a fix for it in your beta version, but it would work.

Or are you referring more generally to all the other fixes I linked to?

[rathlinus]

okay