From 216fdb891a6840269ed0a68fb6194f787af9c2bb Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Wed, 07 Aug 2013 08:24:42 -0400
Subject: [PATCH] Fix base URL resolving on attribute values with no quotes (#1489275)
---
CHANGELOG | 1 +
tests/Framework/BaseReplacer.php | 14 ++++++++++++++
program/lib/Roundcube/rcube_base_replacer.php | 4 ++--
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index a169fab..91f550c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix base URL resolving on attribute values with no quotes (#1489275)
- Fix wrong handling of links with '|' character (#1489276)
- Fix colorspace issue on image conversion using ImageMagick (#1489270)
- Fix XSS vulnerability when saving HTML signatures (#1489251)
diff --git a/program/lib/Roundcube/rcube_base_replacer.php b/program/lib/Roundcube/rcube_base_replacer.php
index fcd85c2..aaaa202 100644
--- a/program/lib/Roundcube/rcube_base_replacer.php
+++ b/program/lib/Roundcube/rcube_base_replacer.php
@@ -44,8 +44,8 @@
public function replace($body)
{
return preg_replace_callback(array(
- '/(src|background|href)=(["\']?)([^"\'\s]+)(\2|\s|>)/Ui',
- '/(url\s*\()(["\']?)([^"\'\)\s]+)(\2)\)/Ui',
+ '/(src|background|href)=(["\']?)([^"\'\s>]+)(\2|\s|>)/i',
+ '/(url\s*\()(["\']?)([^"\'\)\s]+)(\2)\)/i',
),
array($this, 'callback'), $body);
}
diff --git a/tests/Framework/BaseReplacer.php b/tests/Framework/BaseReplacer.php
index e00b9e5..44a9604 100644
--- a/tests/Framework/BaseReplacer.php
+++ b/tests/Framework/BaseReplacer.php
@@ -17,4 +17,18 @@
$this->assertInstanceOf('rcube_base_replacer', $object, "Class constructor");
}
+
+ /**
+ * Test replace()
+ */
+ function test_replace()
+ {
+ $base = 'http://thisshouldntbetheurl.bob.com/';
+ $html = '<A href=http://shouldbethislink.com>Test URL</A>';
+
+ $replacer = new rcube_base_replacer($base);
+ $response = $replacer->replace($html);
+
+ $this->assertSame('<A href="http://shouldbethislink.com">Test URL</A>', $response);
+ }
}
--
Gitblit v1.9.1