diff options
| author | Aleksander Machniak <alec@alec.pl> | 2015-01-13 09:41:41 +0100 |
|---|---|---|
| committer | Aleksander Machniak <alec@alec.pl> | 2015-01-13 09:44:20 +0100 |
| commit | 04994005e7f83a9ae48bd177b898dd17f7aa8e24 (patch) | |
| tree | a54bfa8179f7bd9a70ec77eb8441c1b001a2c6b6 /program | |
| parent | b134f59eb12db00efb3088274f2a0fbc31a5e9fc (diff) | |
Fix XSS issue in style attribute handling (#1490227)
Conflicts:
CHANGELOG
Diffstat (limited to 'program')
| -rw-r--r-- | program/lib/Roundcube/rcube_washtml.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php index 984294376..630a86e01 100644 --- a/program/lib/Roundcube/rcube_washtml.php +++ b/program/lib/Roundcube/rcube_washtml.php @@ -243,8 +243,8 @@ class rcube_washtml $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; } else if ($key == 'style' && ($style = $this->wash_style($value))) { - $quot = strpos($style, '"') !== false ? "'" : '"'; - $t .= ' style=' . $quot . $style . $quot; + // replace double quotes to prevent syntax error and XSS issues (#1490227) + $t .= ' style="' . str_replace('"', '"', $style) . '"'; } else if ($key == 'background' || ($key == 'src' && strtolower($node->tagName) == 'img')) { //check tagName anyway if (($src = $this->config['cid_map'][$value]) |