Changeset 1773 in subversion

Timestamp:

Sep 12, 2008 11:14:34 AM (5 years ago)

Author:

thomasb

Message:

Allow (sanitized) style elements in HTML messages

Location:

trunk/roundcubemail/program

Files:

• include/main.inc (modified) (2 diffs)
• steps/mail/func.inc (modified) (2 diffs)

trunk/roundcubemail/program/include/main.inc

@@ -598 +598 @@
   
   // ignore the whole block if evil styles are detected
-  if (stristr($source, 'expression') || stristr($source, 'behavior'))
+  $stripped = preg_replace('/[^a-z\(:]/', '', rcmail_xss_entitiy_decode($source));
+  if (preg_match('/expression|behavior|url\(|import/', $stripped))
     return '';
 
@@ -631 +632 @@
   return $styles;
   }
+
+
+/**
+ * Decode escaped entities used by known XSS exploits.
+ * See http://downloads.securityfocus.com/vulnerabilities/exploits/26800.eml for examples
+ *
+ * @param string CSS content to decode
+ * @return string Decoded string
+ */
+function rcmail_xss_entitiy_decode($content)
+{
+  $out = html_entity_decode(html_entity_decode($content));
+  $out = preg_replace('/\\\00([a-z0-9]{2})/ie', "chr(hexdec('\\1'))", $out);
+  $out = preg_replace('#/\*.+\*/#Um', '', $out);
+  return $out;
+}
 
 

trunk/roundcubemail/program/steps/mail/func.inc

@@ -603 +603 @@
     }
     
-    /* CSS styles need to be sanitized!
+    // allow CSS styles, will be sanitized by rcmail_washtml_callback()
     if ($p['safe']) {
       $wash_opts['html_elements'][] = 'style';
-      $wash_opts['html_attribs'] = array('type');
-    }
-    */
+    }
     
     $washer = new washtml($wash_opts);
     $washer->add_callback('form', 'rcmail_washtml_callback');
+    $washer->add_callback('style', 'rcmail_washtml_callback');
     $body = $washer->wash($html);
     $REMOTE_OBJECTS = $washer->extlinks;
@@ -699 +698 @@
       break;
       
+    case 'style':
+      // decode all escaped entities and reduce to ascii strings
+      $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($source));
+      
+      // now check for evli strings like expression, behavior or url()
+      if (!preg_match('/expression|behavior|url\(|import/', $css)) {
+        $out = html::tag('style', array('type' => 'text/css'), $content);
+        break;
+      }
+    
     default:
       $out = '';