From 12b7d5f1b5a8be70a34844685993843456db5f46 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 06 May 2016 02:30:33 -0400
Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241)
---
CHANGELOG | 1 +
program/lib/Roundcube/rcube_washtml.php | 2 +-
tests/Framework/Washtml.php | 17 +++++++++++++++++
3 files changed, 19 insertions(+), 1 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 71ac25a..0e41baf 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,7 @@
- Fix bug where contact search menu fields where always unchecked in Larry skin
- Fix autoloading of 'html' class
- Fix bug where Encrypt button appears when switching editor to HTML (#5235)
+- Fix XSS issue in href attribute on area tag (#5240)
RELEASE 1.2-rc
--------------
diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
index 5938d9b..d03f04a 100644
--- a/program/lib/Roundcube/rcube_washtml.php
+++ b/program/lib/Roundcube/rcube_washtml.php
@@ -370,7 +370,7 @@
*/
private function is_link_attribute($tag, $attr)
{
- return $tag == 'a' && $attr == 'href';
+ return ($tag == 'a' || $tag == 'area') && $attr == 'href';
}
/**
diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php
index 9515f0d..2e68179 100644
--- a/tests/Framework/Washtml.php
+++ b/tests/Framework/Washtml.php
@@ -38,6 +38,23 @@
}
/**
+ * Test XSS in area's href (#5240)
+ */
+ function test_href_area()
+ {
+ $html = '<p><area href="data:text/html,<script>alert(document.cookie)</script>">'
+ . '<area href="vbscript:alert(document.cookie)">Internet Explorer</p>'
+ . '<area href="javascript:alert(document.domain)" shape=default>';
+
+ $washer = new rcube_washtml;
+ $washed = $washer->wash($html);
+
+ $this->assertNotRegExp('/data:text/', $washed, "data:text/html in area href");
+ $this->assertNotRegExp('/vbscript:/', $washed, "vbscript: in area href");
+ $this->assertNotRegExp('/javascript:/', $washed, "javascript: in area href");
+ }
+
+ /**
* Test handling HTML comments
*/
function test_comments()
--
Gitblit v1.9.1