Changeset 4461 in subversion

Timestamp:

Jan 28, 2011 10:19:38 AM (2 years ago)

Author:

thomasb

Message:

Don't block CSS styles having important keywords

Location:

trunk/roundcubemail/program

Files:

• include/main.inc (modified) (1 diff)
• steps/mail/func.inc (modified) (1 diff)

trunk/roundcubemail/program/include/main.inc

@@ -873 +873 @@
 
   // ignore the whole block if evil styles are detected
-  $stripped = preg_replace('/[^a-z\(:]/', '', rcmail_xss_entity_decode($source));
-  if (preg_match('/expression|behavior|url\(|import/', $stripped))
+  $stripped = preg_replace('/[^a-z\(:;]/', '', rcmail_xss_entity_decode($source));
+  if (preg_match('/expression|behavior|url\(|import[^a]/', $stripped))
     return '/* evil! */';
 

trunk/roundcubemail/program/steps/mail/func.inc

@@ -830 +830 @@
     case 'style':
       // decode all escaped entities and reduce to ascii strings
-      $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entity_decode($content));
+      $stripped = preg_replace('/[^a-zA-Z\(:;]/', '', rcmail_xss_entity_decode($content));
 
       // now check for evil strings like expression, behavior or url()
-      if (!preg_match('/expression|behavior|url\(|import/', $stripped)) {
+      if (!preg_match('/expression|behavior|url\(|import[^a]/', $stripped)) {
         $out = html::tag('style', array('type' => 'text/css'), $content);
         break;