Changeset 4489 in subversion

Timestamp:

Feb 3, 2011 4:21:26 PM (2 years ago)

Author:

thomasb

Message:

Adapt test for modcss replacements

Location:

trunk/roundcubemail

Files:

• CHANGELOG (modified) (1 diff)
• tests/mailfunc.php (modified) (1 diff)

trunk/roundcubemail/CHANGELOG

@@ -2 +2 @@
 ===========================
 
+- Security: prevent from relaying malicious requests through modcss.inc
 - Fix handling of non-image attachments in multipart/related messages (#1487750)
 - Fix IDNA support when IDN/INTL modules are in use (#1487742)

trunk/roundcubemail/tests/mailfunc.php

@@ -67 +67 @@
     $this->assertPattern('#src="http://evilsite.net/mailings/ex3.jpg"#', $html2, "Allow external images in HTML (safe mode)");
     $this->assertPattern("#url\('?http://evilsite.net/newsletter/image/bg/bg-64.jpg'?\)#", $html2, "Allow external images in CSS (safe mode)");
-    
-    $css = '<link rel="stylesheet" type="text/css" href="?_task=utils&amp;_action=modcss&amp;u='.urlencode('http://anysite.net/styles/mail.css').'&amp;c=foo"';
-    $this->assertPattern('#'.preg_quote($css).'#', $html2, "Filter external styleseehts with bin/modcss.php");
+    $css = '<link rel="stylesheet" .+_u=tmp-[a-z0-9]+\.css.+_action=modcss';
+    $this->assertPattern('#'.$css.'#Ui', $html2, "Filter (anonymized) external styleseehts with utils/modcss.inc");
   }