From 74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 04 Dec 2012 03:17:08 -0500
Subject: [PATCH] - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850)
---
CHANGELOG | 1 +
tests/MailFunc.php | 14 ++++++++++++++
program/lib/washtml.php | 2 +-
3 files changed, 16 insertions(+), 1 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index a47c95d..af7d29c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix XSS vulnerability in vbscript: and data:text links handling (#1488850)
- Fix broken message/part bodies when FETCH response contains more untagged lines (#1488836)
- Fix empty email on identities list after identity update (#1488834)
- Add new identities_level: (4) one identity with possibility to edit only signature
diff --git a/program/lib/washtml.php b/program/lib/washtml.php
index 0d4ffdb..d13d664 100644
--- a/program/lib/washtml.php
+++ b/program/lib/washtml.php
@@ -214,7 +214,7 @@
$key = strtolower($key);
$value = $node->getAttribute($key);
if (isset($this->_html_attribs[$key]) ||
- ($key == 'href' && !preg_match('!^javascript!i', $value)
+ ($key == 'href' && !preg_match('!^(javascript|vbscript|data:text)!i', $value)
&& preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value))
) {
$t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
diff --git a/tests/MailFunc.php b/tests/MailFunc.php
index 967277c..4d4250c 100644
--- a/tests/MailFunc.php
+++ b/tests/MailFunc.php
@@ -97,6 +97,20 @@
}
/**
+ * Test the elimination of some XSS vulnerabilities
+ */
+ function test_html_xss3()
+ {
+ // #1488850
+ $html = '<p><a href="data:text/html,<script>alert(document.cookie)</script>">Firefox</a>'
+ .'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>';
+ $washed = rcmail_wash_html($html, array('safe' => true), array());
+
+ $this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links");
+ $this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links");
+ }
+
+ /**
* Test washtml class on non-unicode characters (#1487813)
*/
function test_washtml_utf8()
--
Gitblit v1.9.1