diff --git a/CHANGELOG b/CHANGELOG index 9273ea00b..3daa61f60 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail =========================== - Don't ignore (global) userlogins/sendmail logs in per_user_logging mode +- Fix security issue in remote content blocking on HTML image and style tags (#6178) RELEASE 1.1.10 -------------- diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php index 7fcd336ef..c4952e99f 100644 --- a/program/lib/Roundcube/rcube_utils.php +++ b/program/lib/Roundcube/rcube_utils.php @@ -540,7 +540,7 @@ class rcube_utils public static function xss_entity_decode($content) { $out = html_entity_decode(html_entity_decode($content)); - $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', + $out = preg_replace_callback('/\\\([0-9a-f]{2,4})\s*/i', array(self, 'xss_entity_decode_callback'), $out); $out = preg_replace('#/\*.*\*/#Ums', '', $out); $out = strip_tags($out); diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php index 1d5d2b4c0..c4d226199 100644 --- a/program/lib/Roundcube/rcube_washtml.php +++ b/program/lib/Roundcube/rcube_washtml.php @@ -386,7 +386,7 @@ class rcube_washtml return $attr == 'background' || $attr == 'color-profile' // SVG || ($attr == 'poster' && $tag == 'video') - || ($attr == 'src' && preg_match('/^(img|source)$/i', $tag)) + || ($attr == 'src' && preg_match('/^(img|image|source)$/i', $tag)) || ($tag == 'image' && $attr == 'href'); // SVG } diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php index 9a6257eda..b11074912 100644 --- a/tests/Framework/Utils.php +++ b/tests/Framework/Utils.php @@ -200,6 +200,9 @@ class Framework_Utils extends PHPUnit_Framework_TestCase $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\006c( javascript:alert('xss') )", 'rcmbody'); $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (2)"); + $mod = rcube_utils::mod_css_styles("background: \\75 \\72 \\6C ('/images/img.png')", 'rcmbody'); + $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (3)"); + // position: fixed (#5264) $mod = rcube_utils::mod_css_styles(".test { position: fixed; }", 'rcmbody'); $this->assertEquals("#rcmbody .test { position: absolute; }", $mod, "Replace position:fixed with position:absolute (0)");