Fix XSS vulnerability when saving HTML signatures (#1489251)

Conflicts: CHANGELOG
11 years ago · 6d26369021
parent 5591a63d70
commit 6d26369021
3 changed files with 49 additions and 1 deletions
--- a/1
+++ b/1
@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail
 ===========================

 - Fix colorspace issue on image conversion using ImageMagick (#1489270)
+- Fix XSS vulnerability when saving HTML signatures (#1489251)
 - Fix XSS vulnerability when editing a message "as new" or draft (#1489251)
 - Fix rewrite rule in .htaccess (#1489240)
 - Fix detecting Turkish language in ISO-8859-9 encoding (#1489252)
--- a/program/steps/settings/edit_identity.inc
+++ b/program/steps/settings/edit_identity.inc
@ -77,7 +77,7 @@ function rcube_identity_form($attrib)
    'signature' => array(
      'name' => rcube_label('signature'),
      'content' => array(
-        'signature'	     => array('type' => 'textarea', 'size' => $t_cols, 'rows' => $t_rows,
+        'signature'      => array('type' => 'textarea', 'size' => $t_cols, 'rows' => $t_rows,
            'spellcheck' => true),
        'html_signature' => array('type' => 'checkbox', 'label' => rcube_label('htmlsignature'),
            'onclick' => 'return rcmail_toggle_editor(this, \'rcmfd_signature\');'),
@ -138,6 +138,7 @@ function rcube_identity_form($attrib)

        $label = !empty($colprop['label']) ? $colprop['label'] :
            rcube_label(str_replace('-', '', $col));
+
        $value = !empty($colprop['value']) ? $colprop['value'] :
            rcmail_get_edit_field($col, $IDENTITY_RECORD[$col], $colprop, $colprop['type']);

--- a/program/steps/settings/save_identity.inc
+++ b/program/steps/settings/save_identity.inc
@ -76,6 +76,15 @@ foreach ($email_checks as $email) {
  }
 }

+// XSS protection in HTML signature (#1489251)
+if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
+  $save_data['signature'] = rcmail_wash_html($save_data['signature']);
+
+  // clear POST data of signature, we want to use safe content
+  // when the form is displayed again
+  unset($_POST['_signature']);
+}
+
 // update an existing contact
 if ($_POST['_iid']) {
  $iid = get_input_value('_iid', RCUBE_INPUT_POST);
@ -167,3 +176,40 @@ if (!empty($_REQUEST['_framed'])) {
 }
 else
  rcmail_overwrite_action('identities');
+
+
+/**
+ * Sanity checks/cleanups on HTML body of signature
+ */
+function rcmail_wash_html($html)
+{
+    // Add header with charset spec., washtml cannot work without that
+    $html = '<html><head>'
+        . '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />'
+        . '</head><body>' . $html . '</body></html>';
+
+    // clean HTML with washhtml by Frederic Motte
+    $wash_opts = array(
+        'show_washed' => false,
+        'allow_remote' => 1,
+        'charset' => RCMAIL_CHARSET,
+        'html_elements' => array('body', 'link'),
+        'html_attribs' => array('rel', 'type'),
+    );
+
+    // initialize HTML washer
+    $washer = new rcube_washtml($wash_opts);
+
+    //$washer->add_callback('form', 'rcmail_washtml_callback');
+    //$washer->add_callback('style', 'rcmail_washtml_callback');
+
+    // Remove non-UTF8 characters (#1487813)
+    $html = rc_utf8_clean($html);
+
+    $html = $washer->wash($html);
+
+    // remove unwanted comments and tags (produced by washtml)
+    $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);
+
+  return $html;
+}