From 1fd9ad242ed100c6c68e969f8cc9ffab48e2f69b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Sun, 1 Oct 2017 11:58:11 +0200
Subject: [PATCH] Fix (again) bug where image data URIs in css style were
 treated as evil/remote in mail preview (#5580)

---
 CHANGELOG                             |  1 +
 program/lib/Roundcube/rcube_utils.php | 13 ++++++++++---
 tests/Framework/Utils.php             |  4 +++-
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index bc0e5f61e..165801f93 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
 
 - Fix rewind(): stream does not support seeking (#5950)
 - Fix bug where HTML messages could have been rendered empty on some systems (#5957)
+- Fix (again) bug where image data URIs in css style were treated as evil/remote in mail preview (#5580)
 
 RELEASE 1.2.6
 -------------
diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
index d0021194f..897c6ad0e 100644
--- a/program/lib/Roundcube/rcube_utils.php
+++ b/program/lib/Roundcube/rcube_utils.php
@@ -419,10 +419,17 @@ class rcube_utils
             if ($allow_remote) {
                 $a_styles = preg_split('/;[\r\n]*/', $styles, -1, PREG_SPLIT_NO_EMPTY);
 
-                foreach ($a_styles as $line) {
+                for ($i=0, $len=count($a_styles); $i < $len; $i++) {
+                    $line     = $a_styles[$i];
                     $stripped = preg_replace('/[^a-z\(:;]/i', '', $line);
-                    // ... and only allow strict url() values
-                    if (stripos($stripped, 'url(') && !preg_match($strict_url_regexp, $line)) {
+
+                    // allow data:image uri, join with continuation
+                    if (stripos($stripped, 'url(data:image')) {
+                        $a_styles[$i] .= ';' . $a_styles[$i+1];
+                        unset($a_styles[$i+1]);
+                    }
+                    // allow strict url() values only
+                    else if (stripos($stripped, 'url(') && !preg_match($strict_url_regexp, $line)) {
                         $a_styles = array('/* evil! */');
                         break;
                     }
diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
index 71e9f3e30..f4cf17cc7 100644
--- a/tests/Framework/Utils.php
+++ b/tests/Framework/Utils.php
@@ -217,7 +217,9 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
 
         // allow data URIs with images (#5580)
         $mod = rcube_utils::mod_css_styles("body { background-image: url(data:image/png;base64,123); }", 'rcmbody');
-        $this->assertEquals("#rcmbody { background-image: url(data:image/png;base64,123); }", $mod, "Data URIs in url() allowed");
+        $this->assertContains("#rcmbody { background-image: url(data:image/png;base64,123);", $mod, "Data URIs in url() allowed [1]");
+        $mod = rcube_utils::mod_css_styles("body { background-image: url(data:image/png;base64,123); }", 'rcmbody', true);
+        $this->assertContains("#rcmbody { background-image: url(data:image/png;base64,123);", $mod, "Data URIs in url() allowed [2]");
     }
 
     function test_xss_entity_decode()