File 0001-Fix-bug-where-comment-notation-within-styl... of Package roundcubemail

File 0001-Fix-bug-where-comment-notation-within-style-tag-woul.patch of Package roundcubemail (Revision 25)

Currently displaying revision 25 , Show latest

From 9bfacb4d3c6e687a3921fe52dfc98d67db0f99fa Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 5 May 2017 11:51:23 +0200
Subject: [PATCH 1/6] Fix bug where comment notation within style tag would
 cause the whole style to be ignored (#5747)

---
 CHANGELOG                             |  2 ++
 program/lib/Roundcube/rcube_utils.php |  1 +
 tests/Framework/Utils.php             | 13 +++++++++++++
 3 files changed, 16 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index facd8b329..5bd46f0d3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,8 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix bug where comment notation within style tag would cause the whole style to be ignored (#5747)
+
 RELEASE 1.2.5
 -------------
 - Fix re-positioning of the fixed header of messages list in Chrome when using minimal mode toggle and About dialog (#5711)
diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
index 34d5d7193..c198c30e7 100644
--- a/program/lib/Roundcube/rcube_utils.php
+++ b/program/lib/Roundcube/rcube_utils.php
@@ -499,6 +499,7 @@ class rcube_utils
     public static function xss_entity_decode($content)
     {
         $out = html_entity_decode(html_entity_decode($content));
+        $out = trim(preg_replace('/(^$)/', '', trim($out)));
         $out = preg_replace_callback('/\\\([0-9a-f]{4})/i',
             array(self, 'xss_entity_decode_callback'), $out);
         $out = preg_replace('#/\*.*\*/#Ums', '', $out);
diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
index ba04e1545..71e9f3e30 100644
--- a/tests/Framework/Utils.php
+++ b/tests/Framework/Utils.php
@@ -220,6 +220,19 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
         $this->assertEquals("#rcmbody { background-image: url(data:image/png;base64,123); }", $mod, "Data URIs in url() allowed");
     }
 
+    function test_xss_entity_decode()
+    {
+        $mod = rcube_utils::xss_entity_decode("&lt;img/src=x onerror=alert(1)// </b>");
+        $this->assertNotContains('<img', $mod, "Strip (encoded) tags from style node");
+
+        $mod = rcube_utils::xss_entity_decode('#foo:after{content:"\003Cimg/src=x onerror=alert(2)>";}');
+        $this->assertNotContains('<img', $mod, "Strip (encoded) tags from content property");
+
+        // #5747
+        $mod = rcube_utils::xss_entity_decode('');
+        $this->assertContains('#foo', $mod, "Strip HTML comments from content, but not the content");
+    }
+
     /**
      * Check rcube_utils::explode_quoted_string()
      */
-- 
2.13.0