From 7d14065baa6c51346e0ec0253c06ac822f082278 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Fri, 06 May 2016 02:30:17 -0400 Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241) --- CHANGELOG | 1 + program/lib/Roundcube/rcube_washtml.php | 2 +- tests/Framework/Washtml.php | 17 +++++++++++++++++ 3 files changed, 19 insertions(+), 1 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 4d7719a..7420e7c 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -3,6 +3,7 @@ - Fix message list multi-select/deselect issue (#5219) - Fix bug where contact search menu fields where always unchecked in Larry skin +- Fix XSS issue in href attribute on area tag (#5240) RELEASE 1.1.5 ------------- diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php index 54c1cd8..6535e3b 100644 --- a/program/lib/Roundcube/rcube_washtml.php +++ b/program/lib/Roundcube/rcube_washtml.php @@ -370,7 +370,7 @@ */ private function is_link_attribute($tag, $attr) { - return $tag == 'a' && $attr == 'href'; + return ($tag == 'a' || $tag == 'area') && $attr == 'href'; } /** diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php index 9515f0d..2e68179 100644 --- a/tests/Framework/Washtml.php +++ b/tests/Framework/Washtml.php @@ -38,6 +38,23 @@ } /** + * Test XSS in area's href (#5240) + */ + function test_href_area() + { + $html = '<p><area href="data:text/html,<script>alert(document.cookie)</script>">' + . '<area href="vbscript:alert(document.cookie)">Internet Explorer</p>' + . '<area href="javascript:alert(document.domain)" shape=default>'; + + $washer = new rcube_washtml; + $washed = $washer->wash($html); + + $this->assertNotRegExp('/data:text/', $washed, "data:text/html in area href"); + $this->assertNotRegExp('/vbscript:/', $washed, "vbscript: in area href"); + $this->assertNotRegExp('/javascript:/', $washed, "javascript: in area href"); + } + + /** * Test handling HTML comments */ function test_comments() -- Gitblit v1.9.1