Get rid of vulnerable preg_replace eval and create_function (#1485686) + correctly handle base and link tags in html messages

author: thomascube <thomas@roundcube.net> 2009-01-22 14:47:23 +0000
committer: thomascube <thomas@roundcube.net> 2009-01-22 14:47:23 +0000
commit: aa055c931a68547763f7bb89425a08e8ceecb749 (patch)
tree: ece66b96ce0bc8c1f892f6c620a32c93f5df621f /program/include
parent: 4f27148d400661c81005b496ac7c05b6c6ed9483 (diff)
3 files changed, 158 insertions, 19 deletions
diff --git a/program/include/main.inc b/program/include/main.inc
index bdf711633..5ee652269 100644
--- a/program/include/main.inc
+++ b/program/include/main.inc
@@ -587,25 +587,24 @@ function rcmail_get_edit_field($col, $value, $attrib, $type='text')
  * @param string Container ID to use as prefix
  * @return string Modified CSS source
  */
-function rcmail_mod_css_styles($source, $container_id, $base_url = '')
+function rcmail_mod_css_styles($source, $container_id)
   {
-  $a_css_values = array();
   $last_pos = 0;
+  $replacements = new rcube_string_replacer;
   
   // ignore the whole block if evil styles are detected
   $stripped = preg_replace('/[^a-z\(:]/', '', rcmail_xss_entitiy_decode($source));
   if (preg_match('/expression|behavior|url\(|import/', $stripped))
-    return '';
+    return '/* evil! */';
 
   // cut out all contents between { and }
   while (($pos = strpos($source, '{', $last_pos)) && ($pos2 = strpos($source, '}', $pos)))
   {
-    $key = sizeof($a_css_values);
-    $a_css_values[$key] = substr($source, $pos+1, $pos2-($pos+1));
-    $source = substr($source, 0, $pos+1) . "<<str_replacement[$key]>>" . substr($source, $pos2, strlen($source)-$pos2);
+    $key = $replacements->add(substr($source, $pos+1, $pos2-($pos+1)));
+    $source = substr($source, 0, $pos+1) . $replacements->get_replacement($key) . substr($source, $pos2, strlen($source)-$pos2);
     $last_pos = $pos+2;
   }
-
+  
   // remove html comments and add #container to each tag selector.
   // also replace body definition because we also stripped off the <body> tag
   $styles = preg_replace(
@@ -621,17 +620,8 @@ function rcmail_mod_css_styles($source, $container_id, $base_url = '')
     ),
     $source);
   
-  // replace all @import statements to modify the imported CSS sources too
-  $styles = preg_replace_callback(
-    '/@import\s+(url\()?[\'"]?([^\)\'"]+)[\'"]?(\))?/im',
-    create_function('$matches', "return sprintf(\"@import url('./bin/modcss.php?u=%s&c=%s')\", urlencode(make_absolute_url(\$matches[2],'$base_url')), urlencode('$container_id'));"),
-    $styles);
-  
   // put block contents back in
-  $styles = preg_replace_callback(
-    '/<<str_replacement\[([0-9]+)\]>>/',
-    create_function('$matches', "\$values = ".var_export($a_css_values, true)."; return \$values[\$matches[1]];"),
-    $styles);
+  $styles = $replacements->resolve($styles);
 
   return $styles;
   }
@@ -647,13 +637,24 @@ function rcmail_mod_css_styles($source, $container_id, $base_url = '')
 function rcmail_xss_entitiy_decode($content)
 {
   $out = html_entity_decode(html_entity_decode($content));
-  $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', create_function('$matches', 'return chr(hexdec($matches[1]));'), $out);
+  $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', 'rcmail_xss_entitiy_decode_callback', $out);
   $out = preg_replace('#/\*.*\*/#Um', '', $out);
   return $out;
 }
 
 
 /**
+ * preg_replace_callback callback for rcmail_xss_entitiy_decode_callback
+ *
+ * @param array matches result from preg_replace_callback
+ * @return string decoded entity
+ */ 
+function rcmail_xss_entitiy_decode_callback($matches)
+{ 
+  return chr(hexdec($matches[1]));
+}
+
+/**
  * Compose a valid attribute string for HTML tags
  *
  * @param array Named tag attributes
@@ -1209,4 +1210,26 @@ function rcube_html_editor($mode='')
   $OUTPUT->add_script('rcmail_editor_init("$__skin_path", "'.JQ($tinylang).'", '.intval($CONFIG['enable_spellcheck']).', "'.$mode.'");');
 }
 
+
+
+/**
+ * Helper class to turn relative urls into absolute ones
+ * using a predefined base
+ */
+class rcube_base_replacer
+{
+  private $base_url;
+  
+  public function __construct($base)
+  {
+    $this->base_url = $base;
+  }
+  
+  public function callback($matches)
+  {
+    return $matches[1] . '="' . make_absolute_url($matches[3], $this->base_url) . '"';
+  }
+}
+
+
 ?>
diff --git a/program/include/rcube_shared.inc b/program/include/rcube_shared.inc
index 244225ca9..c1c056109 100644
--- a/program/include/rcube_shared.inc
+++ b/program/include/rcube_shared.inc
@@ -309,7 +309,7 @@ function make_absolute_url($path, $base_url)
     return $path;
 
   // cut base_url to the last directory
-  if (strpos($base_url, '/')>7)
+  if (strrpos($base_url, '/')>7)
   {
     $host_url = substr($base_url, 0, strpos($base_url, '/'));
     $base_url = substr($base_url, 0, strrpos($base_url, '/'));
diff --git a/program/include/rcube_string_replacer.php b/program/include/rcube_string_replacer.php
new file mode 100644
index 000000000..fe082a583
--- /dev/null
+++ b/program/include/rcube_string_replacer.php
@@ -0,0 +1,116 @@
+<?php
+
+/*
+ +-----------------------------------------------------------------------+
+ | program/include/rcube_string_replacer.php                             |
+ |                                                                       |
+ | This file is part of the RoundCube Webmail client                     |
+ | Copyright (C) 2009, RoundCube Dev. - Switzerland                      |
+ | Licensed under the GNU GPL                                            |
+ |                                                                       |
+ | PURPOSE:                                                              |
+ |   Handle string replacements based on preg_replace_callback           |
+ |                                                                       |
+ +-----------------------------------------------------------------------+
+ | Author: Thomas Bruederli <roundcube@gmail.com>                        |
+ +-----------------------------------------------------------------------+
+
+ $Id:  $
+
+*/
+
+
+/**
+ * Helper class for string replacements based on preg_replace_callback
+ *
+ * @package Core
+ */
+class rcube_string_replacer
+{
+  public static $pattern = '/##str_replacement\[([0-9]+)\]##/';
+
+  private $values = array();
+
+
+  /**
+   * Add a string to the internal list
+   *
+   * @param string String value 
+   * @return int Index of value for retrieval
+   */
+  public function add($str)
+  {
+    $i = count($this->values);
+    $this->values[$i] = $str;
+    return $i;
+  }
+
+  /**
+   * Build replacement string
+   */
+  public function get_replacement($i)
+  {
+    return '##str_replacement['.$i.']##';
+  }
+
+  /**
+   * Callback function used to build HTML links around URL strings
+   *
+   * @param array Matches result from preg_replace_callback
+   * @return int Index of saved string value
+   */
+  public function link_callback($matches)
+  {
+    $i = -1;
+    $scheme = strtolower($matches[1]);
+
+    if ($scheme == 'http' || $scheme == 'https' || $scheme == 'ftp') {
+      $url = $matches[1] . '://' . $matches[2];
+      $i = $this->add(html::a(array('href' => $url, 'target' => "_blank"), Q($url)));
+    }
+    else if ($matches[2] == 'www.') {
+      $url = $matches[2] . $matches[3];
+      $i = $this->add($matches[1] . html::a(array('href' => 'http://' . $url, 'target' => "_blank"), Q($url)));
+    }
+
+    return $i >= 0 ? $this->get_replacement($i) : '';
+  }
+
+  /**
+   * Callback function used to build mailto: links around e-mail strings
+   *
+   * @param array Matches result from preg_replace_callback
+   * @return int Index of saved string value
+   */
+  public function mailto_callback($matches)
+  {
+    $i = $this->add(html::a(array(
+        'href' => 'mailto:' . $matches[1],
+        'onclick' => "return ".JS_OBJECT_NAME.".command('compose','".JQ($matches[1])."',this)",
+      ),
+      Q($matches[1])));
+
+    return $i >= 0 ? $this->get_replacement($i) : '';
+  }
+
+  /**
+   * Look up the index from the preg_replace matches array
+   * and return the substitution value.
+   *
+   * @param array Matches result from preg_replace_callback
+   * @return string Value at index $matches[1]
+   */
+  public function replace_callback($matches)
+  {
+    return $this->values[$matches[1]];
+  }
+
+  /**
+   * Replace substituted strings with original values
+   */
+  public function resolve($str)
+  {
+    return preg_replace_callback(self::$pattern, array($this, 'replace_callback'), $str);
+  }
+
+}
+\ No newline at end of file
author	thomascube <thomas@roundcube.net>	2009-01-22 14:47:23 +0000
committer	thomascube <thomas@roundcube.net>	2009-01-22 14:47:23 +0000
commit	aa055c931a68547763f7bb89425a08e8ceecb749 (patch)
tree	ece66b96ce0bc8c1f892f6c620a32c93f5df621f /program/include
parent	4f27148d400661c81005b496ac7c05b6c6ed9483 (diff)