diff options
| author | thomascube <thomas@roundcube.net> | 2011-12-10 01:50:03 +0000 |
|---|---|---|
| committer | thomascube <thomas@roundcube.net> | 2011-12-10 01:50:03 +0000 |
| commit | 98c2d69acf3001379dc008dc52b77b618c291140 (patch) | |
| tree | a3523e1460d1e67a8152ca6b974447213ea3ec01 | |
| parent | 854397b216463d77561b8adadf880c3fbbcb8885 (diff) | |
Be more strict in style attribute filtering
| -rw-r--r-- | program/lib/washtml.php | 2 | ||||
| -rw-r--r-- | tests/src/BID-26800.txt | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/program/lib/washtml.php b/program/lib/washtml.php index 8bbc136e1..f8c3251ad 100644 --- a/program/lib/washtml.php +++ b/program/lib/washtml.php @@ -168,7 +168,7 @@ class washtml || ($src = $this->config['cid_map'][$this->config['base_url'].$match[2]])) { $value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')'; } - else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) { + else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) { if ($this->config['allow_remote']) $value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')'; else diff --git a/tests/src/BID-26800.txt b/tests/src/BID-26800.txt index 513516c09..e4e2fe795 100644 --- a/tests/src/BID-26800.txt +++ b/tests/src/BID-26800.txt @@ -10,13 +10,14 @@ <h1>2 test</h1> <p><div> block</p> <div style="font-style:italic">valid css</div> +<div style="color:red; background:url('//somedomain.com/somepath/somefile.png')"> <div style="{ left:expression( alert('expression!') ) }"> <div style="{ background:url( alert('URL!') ) }"> <h1>3 test</h1> <p>Inject comment text</p> <div style="{ left:exp/* */ression( alert('xss3') ) }"> -<div style="{ background:u/* */rl( alert('xssurl3') ) }"> +<div style=" background:u/* */rl( alert('xssurl3') ) "> <h1>4 test</h1> <p>Using reverse solid to directe the codepoint</p> |