diff options
| author | Aleksander Machniak <alec@alec.pl> | 2013-08-04 12:41:30 +0200 |
|---|---|---|
| committer | Aleksander Machniak <alec@alec.pl> | 2013-08-04 12:41:30 +0200 |
| commit | ce5a6496fd6039962ba7424d153278e41ae8761b (patch) | |
| tree | 50174a0153cfa90125960ccbef32da5e6c2a238f /program/steps/settings/save_identity.inc | |
| parent | b825f86108a91957f6467176e418cfc257874658 (diff) | |
Fix XSS vulnerability when saving HTML signatures (#1489251)
Diffstat (limited to 'program/steps/settings/save_identity.inc')
| -rw-r--r-- | program/steps/settings/save_identity.inc | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc index 34d8be268..d3b132f8b 100644 --- a/program/steps/settings/save_identity.inc +++ b/program/steps/settings/save_identity.inc @@ -76,6 +76,15 @@ foreach ($email_checks as $email) { } } +// XSS protection in HTML signature (#1489251) +if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) { + $save_data['signature'] = rcmail_wash_html($save_data['signature']); + + // clear POST data of signature, we want to use safe content + // when the form is displayed again + unset($_POST['_signature']); +} + // update an existing contact if ($_POST['_iid']) { $iid = get_input_value('_iid', RCUBE_INPUT_POST); @@ -167,3 +176,40 @@ if (!empty($_REQUEST['_framed'])) { } else rcmail_overwrite_action('identities'); + + +/** + * Sanity checks/cleanups on HTML body of signature + */ +function rcmail_wash_html($html) +{ + // Add header with charset spec., washtml cannot work without that + $html = '<html><head>' + . '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />' + . '</head><body>' . $html . '</body></html>'; + + // clean HTML with washhtml by Frederic Motte + $wash_opts = array( + 'show_washed' => false, + 'allow_remote' => 1, + 'charset' => RCMAIL_CHARSET, + 'html_elements' => array('body', 'link'), + 'html_attribs' => array('rel', 'type'), + ); + + // initialize HTML washer + $washer = new rcube_washtml($wash_opts); + + //$washer->add_callback('form', 'rcmail_washtml_callback'); + //$washer->add_callback('style', 'rcmail_washtml_callback'); + + // Remove non-UTF8 characters (#1487813) + $html = rc_utf8_clean($html); + + $html = $washer->wash($html); + + // remove unwanted comments and tags (produced by washtml) + $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html); + + return $html; +} |