summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAleksander Machniak <alec@alec.pl>2014-05-20 19:25:45 +0200
committerAleksander Machniak <alec@alec.pl>2014-05-20 19:25:45 +0200
commit82ed256f6eeba8dce305f3953aa70681351c9bad (patch)
tree98364f351cdf3bd23d9cccc02e1dd1b40ed5420a
parent79babb69ab39a6b511d8a776aed6f7642a9eedbd (diff)
Fix incorrect handling of HTML comments in messages sanitization code (#1489904)
-rw-r--r--CHANGELOG1
-rw-r--r--program/lib/Roundcube/rcube_washtml.php2
-rw-r--r--tests/Framework/Washtml.php10
3 files changed, 12 insertions, 1 deletions
diff --git a/CHANGELOG b/CHANGELOG
index 27286e8e5..1b093a5a9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -26,6 +26,7 @@ CHANGELOG Roundcube Webmail
- Fix unintentional draft autosave request if autosave is disabled (#1489882)
- Fix malformed References: header in send/saved mail (#1489891)
- Fix handling unicode characters in links (#1489898)
+- Fix incorrect handling of HTML comments in messages sanitization code (#1489904)
RELEASE 1.0.1
-------------
diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
index e23e5b21d..5f40eecf4 100644
--- a/program/lib/Roundcube/rcube_washtml.php
+++ b/program/lib/Roundcube/rcube_washtml.php
@@ -456,7 +456,7 @@ class rcube_washtml
// Remove invalid HTML comments (#1487759)
// Don't remove valid conditional comments
// Don't remove MSOutlook (<!-->) conditional comments (#1489004)
- $html = preg_replace('/<!--[^->\[\n]+>/', '', $html);
+ $html = preg_replace('/<!--[^-<>\[\n]+>/', '', $html);
// fix broken nested lists
self::fix_broken_lists($html);
diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php
index ab1ada05f..5c15c692c 100644
--- a/tests/Framework/Washtml.php
+++ b/tests/Framework/Washtml.php
@@ -53,6 +53,16 @@ class Framework_Washtml extends PHPUnit_Framework_TestCase
$washed = $washer->wash($html);
$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>test</p>', $washed, "HTML invalid comments (#1487759)");
+
+ $html = "<p>para1</p><!-- comment --><p>para2</p>";
+ $washed = $washer->wash($html);
+
+ $this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><!-- node type 8 --><p>para2</p>', $washed, "HTML comments - simple comment");
+
+ $html = "<p>para1</p><!-- <hr> comment --><p>para2</p>";
+ $washed = $washer->wash($html);
+
+ $this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><!-- node type 8 --><p>para2</p>', $washed, "HTML comments - tags inside (#1489904)");
}
/**