File 0009-Fix-bug-in-remote-content-blocking-on-HTML... of Package roundcubemail

File 0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch of Package roundcubemail (Revision 94)

Currently displaying revision 94 , Show latest

From 24dcdb54141e65f3672d459431fcf612efd68af3 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Wed, 14 Feb 2018 20:19:32 +0100
Subject: [PATCH 09/12] Fix bug in remote content blocking on HTML image and
 style tags (#6178)

---
 CHANGELOG                               | 1 +
 program/lib/Roundcube/rcube_utils.php   | 4 ++--
 program/lib/Roundcube/rcube_washtml.php | 2 +-
 tests/Framework/Utils.php               | 3 +++
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 0872463d9..55a45a74a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -6,6 +6,7 @@ CHANGELOG Roundcube Webmail
 - Fix duplicated labels in Test SMTP Config section (#6166)
 - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
 - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
+- Fix bug in remote content blocking on HTML image and style tags (#6178)
 
 RELEASE 1.3.4
 -------------
diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
index ad0a6b05d..ff7d327b0 100644
--- a/program/lib/Roundcube/rcube_utils.php
+++ b/program/lib/Roundcube/rcube_utils.php
@@ -496,11 +496,11 @@ class rcube_utils
      */
     public static function xss_entity_decode($content)
     {
-        $callback = function($matches) { return chr(hexdec($matches[1])); };
+        $callback = function($matches) { return chr(hexdec(trim($matches[1]))); };
 
         $out = html_entity_decode(html_entity_decode($content));
         $out = trim(preg_replace('/(^$)/', '', trim($out)));
-        $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', $callback, $out);
+        $out = preg_replace_callback('/\\\([0-9a-f]{2,4})\s*/i', $callback, $out);
         $out = preg_replace('#/\*.*\*/#Ums', '', $out);
         $out = strip_tags($out);
 
diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
index 0880764a0..ac1af74ef 100644
--- a/program/lib/Roundcube/rcube_washtml.php
+++ b/program/lib/Roundcube/rcube_washtml.php
@@ -408,7 +408,7 @@ class rcube_washtml
         return $attr == 'background'
             || $attr == 'color-profile' // SVG
             || ($attr == 'poster' && $tag == 'video')
-            || ($attr == 'src' && preg_match('/^(img|source|input|video|audio)$/i', $tag))
+            || ($attr == 'src' && preg_match('/^(img|image|source|input|video|audio)$/i', $tag))
             || ($tag == 'image' && $attr == 'href'); // SVG
     }
 
diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
index 2a5c090d9..599ffedc2 100644
--- a/tests/Framework/Utils.php
+++ b/tests/Framework/Utils.php
@@ -206,6 +206,9 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
         $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\006c( javascript:alert(&#039;xss&#039;) )", 'rcmbody');
         $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (2)");
 
+        $mod = rcube_utils::mod_css_styles("background: \\75 \\72 \\6C ('/images/img.png')", 'rcmbody');
+        $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (3)");
+
         // position: fixed (#5264)
         $mod = rcube_utils::mod_css_styles(".test { position: fixed; }", 'rcmbody');
         $this->assertEquals("#rcmbody .test { position: absolute; }", $mod, "Replace position:fixed with position:absolute (0)");
-- 
2.14.3