diff options
| -rw-r--r-- | program/include/rcube_message.php | 1 | ||||
| -rw-r--r-- | program/lib/washtml.php | 108 | ||||
| -rw-r--r-- | program/steps/mail/func.inc | 66 | ||||
| -rw-r--r-- | program/steps/mail/get.inc | 4 |
4 files changed, 128 insertions, 51 deletions
diff --git a/program/include/rcube_message.php b/program/include/rcube_message.php index 6654c3f90..48f999785 100644 --- a/program/include/rcube_message.php +++ b/program/include/rcube_message.php @@ -57,7 +57,6 @@ class rcube_message list(, $this->sender) = each($this->imap->decode_address_list($this->headers->from)); $this->set_safe((intval($_GET['_safe']) || $_SESSION['safe_messages'][$uid])); - $this->set_safe(0); $this->opt = array( 'safe' => $this->is_safe, diff --git a/program/lib/washtml.php b/program/lib/washtml.php index dfd36d224..340dc93f3 100644 --- a/program/lib/washtml.php +++ b/program/lib/washtml.php @@ -33,7 +33,8 @@ * * SYNOPSIS: * - * washtml::wash($html, $config, $full); + * $washer = new washtml($config); + * $washer->wash($html); * It return a sanityzed string of the $html parameter without html and head tags. * $html is a string containing the html code to wash. * $config is an array containing options: @@ -42,11 +43,11 @@ * $config['show_washed'] is a boolean to include washed out attributes as x-washed * $config['cid_map'] is an array where cid urls index urls to replace them. * $config['charset'] is a string containing the charset of the HTML document if it is not defined in it. - * $full is a reference to a boolean that is set to true if no remote images are removed. (FE: show remote images link) + * $washer->extlinks is a reference to a boolean that is set to true if remote images were removed. (FE: show remote images link) * * INTERNALS: * - * Only tags and attributes in the globals $html_elements and $html_attributes + * Only tags and attributes in the static lists $html_elements and $html_attributes * are kept, inline styles are also filtered: all style identifiers matching * /[a-z\-]/i are allowed. Values matching colors, sizes, /[a-z\-]/i and safe * urls if allowed and cid urls if mapped are kept. @@ -72,15 +73,51 @@ class washtml { + /* Allowed HTML elements (default) */ + static $html_elements = array('a', 'abbr', 'acronym', 'address', 'area', 'b', 'basefont', 'bdo', 'big', 'blockquote', 'br', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'fieldset', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'ins', 'label', 'legend', 'li', 'map', 'menu', 'ol', 'p', 'pre', 'q', 's', 'samp', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'img'); + + /* Ignore these HTML tags but process their content */ + static $ignore_elements = array('html', 'body'); + + /* Allowed HTML attributes */ + static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir', 'background'); + + /* State for linked objects in HTML */ + public $extlinks = false; + + /* Current settings */ + private $config = array(); + /* Registered callback functions for tags */ + private $handlers = array(); + /* Allowed HTML elements */ - static $html_elements = array('a', 'abbr', 'acronym', 'address', 'area', 'b', 'basefont', 'bdo', 'big', 'blockquote', 'body', 'br', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'fieldset', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'ins', 'label', 'legend', 'li', 'map', 'menu', 'ol', 'p', 'pre', 'q', 's', 'samp', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'title', 'tr', 'tt', 'u', 'ul', 'var', 'img'); + private $_html_elements = array(); - /* Allowed HTML attributes */ - static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir', 'background'); + /* Ignore these HTML tags but process their content */ + private $_ignore_elements = array(); + /* Allowed HTML attributes */ + private $_html_attribs = array(); + + + /* Constructor */ + public function __construct($p = array()) { + $this->_html_elements = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements) ; + $this->_html_attribs = array_flip((array)$p['html_attribs']) + array_flip(self::$html_attribs); + $this->_ignore_elements = array_flip((array)$p['ignore_elements']) + array_flip(self::$ignore_elements); + unset($p['html_elements'], $p['html_attribs'], $p['ignore_elements']); + $this->config = $p + array('show_washed'=>true, 'allow_remote'=>false, 'cid_map'=>array()); + } + + /* Register a callback function for a certain tag */ + public function add_callback($tagName, $callback) + { + $this->handlers[$tagName] = $callback; + } + /* Check CSS style */ - static function wash_style($style, $config, &$full) { + private function wash_style($style) { $s = ''; foreach(explode(';', $style) as $declaration) { @@ -96,12 +133,12 @@ class washtml ')\s*/i', $str, $match)) { if($match[2]) { if(preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) { - if($config['allow_remote']) + if($this->config['allow_remote']) $value .= ' url(\''.htmlspecialchars($url[0], ENT_QUOTES).'\')'; else - $full = false; + $this->extlinks = true; } else if(preg_match('/^cid:(.*)$/i', $match[2], $cid)) - $value .= ' url(\''.htmlspecialchars($config['cid_map']['cid:'.$cid[1]], ENT_QUOTES) . '\')'; + $value .= ' url(\''.htmlspecialchars($this->config['cid_map']['cid:'.$cid[1]], ENT_QUOTES) . '\')'; } else if($match[0] != 'url' && $match[0] != 'rbg')//whitelist ? $value .= ' ' . $match[0]; $str = substr($str, strlen($match[0])); @@ -114,39 +151,39 @@ class washtml } /* Take a node and return allowed attributes and check values */ - static function wash_attribs($node, $config, &$full) { + private function wash_attribs($node) { $t = ''; $washed; foreach($node->attributes as $key => $plop) { $key = strtolower($key); $value = $node->getAttribute($key); - if((in_array($key, self::$html_attribs)) || + if(isset($this->_html_attribs[$key]) || ($key == 'href' && preg_match('/^(http|https|ftp|mailto):.*/i', $value))) $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; - else if($key == 'style' && ($style = self::wash_style($value, $config, $full))) + else if($key == 'style' && ($style = $this->wash_style($value))) $t .= ' style="' . $style . '"'; else if($key == 'src' && strtolower($node->tagName) == 'img') { //check tagName anyway if(preg_match('/^(http|https|ftp):.*/i', $value)) { - if($config['allow_remote']) + if($this->config['allow_remote']) $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; else { - $full = false; - if ($config['blocked_src']) - $t .= ' src="' . htmlspecialchars($config['blocked_src'], ENT_QUOTES) . '"'; + $this->extlinks = true; + if ($this->config['blocked_src']) + $t .= ' src="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"'; } } else if(preg_match('/^cid:(.*)$/i', $value, $cid)) - $t .= ' ' . $key . '="' . htmlspecialchars($config['cid_map']['cid:'.$cid[1]], ENT_QUOTES) . '"'; + $t .= ' ' . $key . '="' . htmlspecialchars($this->config['cid_map']['cid:'.$cid[1]], ENT_QUOTES) . '"'; } else $washed .= ($washed?' ':'') . $key; } - return $t . ($washed && $config['show_washed']?' x-washed="'.$washed.'"':''); + return $t . ($washed && $this->config['show_washed']?' x-washed="'.$washed.'"':''); } /* The main loop that recurse on a node tree. * It output only allowed tags with allowed attributes * and allowed inline styles */ - static function dumpHtml($node, $config, &$full) { + private function dumpHtml($node) { if(!$node->hasChildNodes()) return ''; @@ -157,23 +194,31 @@ class washtml switch($node->nodeType) { case XML_ELEMENT_NODE: //Check element $tagName = strtolower($node->tagName); - if(in_array($tagName, self::$html_elements)) { - $content = self::dumpHtml($node, $config, $full); - $dump .= '<' . $tagName . self::wash_attribs($node, $config, $full) . + if($callback = $this->handlers[$tagName]) { + $dump .= call_user_func($callback, $tagName, $this->wash_attribs($node), $this->dumpHtml($node)); + } else if(isset($this->_html_elements[$tagName])) { + $content = $this->dumpHtml($node); + $dump .= '<' . $tagName . $this->wash_attribs($node) . ($content?">$content</$tagName>":' />'); - } else if($tagName == 'html' || $tagName == 'body') { - $dump .= self::dumpHtml($node, $config, $full); //Just ignored + } else if(isset($this->_ignore_elements[$tagName])) { + $dump .= '<!-- ' . htmlspecialchars($tagName, ENT_QUOTES) . ' ignored -->'; + $dump .= $this->dumpHtml($node); //Just ignored } else $dump .= '<!-- ' . htmlspecialchars($tagName, ENT_QUOTES) . ' not allowed -->'; break; + case XML_CDATA_SECTION_NODE: + $dump .= $node->nodeValue; + break; case XML_TEXT_NODE: $dump .= htmlspecialchars($node->nodeValue); break; case XML_HTML_DOCUMENT_NODE: - $dump .= self::dumpHtml($node, $config, $full); + $dump .= $this->dumpHtml($node); + break; + case XML_DOCUMENT_TYPE_NODE: break; - case XML_DOCUMENT_TYPE_NODE: break; default: + $dump . '<!-- node type ' . $node->nodeType . ' -->'; } } while($node = $node->nextSibling); @@ -182,13 +227,12 @@ class washtml /* Main function, give it untrusted HTML, tell it if you allow loading * remote images and give it a map to convert "cid:" urls. */ - static function wash($html, $config=array(), &$full=true) { - $config += array('show_washed'=>true, 'allow_remote'=>false, 'cid_map'=>array()); + public function wash($html) { //Charset seems to be ignored (probably if defined in the HTML document) - $node = new DOMDocument('1.0', $config['charset']); - $full = true; + $node = new DOMDocument('1.0', $this->config['charset']); + $this->extlinks = false; @$node->loadHTML($html); - return self::dumpHtml($node, $config, $full); + return $this->dumpHtml($node); } } diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc index 58c9c8bd7..36605894a 100644 --- a/program/steps/mail/func.inc +++ b/program/steps/mail/func.inc @@ -539,12 +539,14 @@ function rcmail_get_messagecount_text($count=NULL, $page=NULL) * @param bool True if part should be converted to plaintext * @return string Formatted HTML string */ -function rcmail_print_body($part, $safe=false, $plain=false) +function rcmail_print_body($part, $p = array()) { global $REMOTE_OBJECTS; + $p += array('safe' => false, 'plain' => false, 'inline_html' => true); + // convert html to text/plain - if ($part->ctype_secondary == 'html' && $plain) { + if ($part->ctype_secondary == 'html' && $p['plain']) { $txt = new html2text($part->body, false, true); $body = $txt->get_text(); $part->ctype_secondary = 'plain'; @@ -553,25 +555,40 @@ function rcmail_print_body($part, $safe=false, $plain=false) else if ($part->ctype_secondary == 'html') { // charset was converted to UTF-8 in rcube_imap::get_message_part() -> change charset specification in HTML accordingly $html = $part->body; - if(preg_match('/(\s+content=[\'"]\w+\/\w+;\s+charset)=([a-z0-9-]+)/i', $html)) - $html = preg_replace('/(\s+content=[\'"]\w+\/\w+;\s+charset)=([a-z0-9-]+)/i', '\\1='.RCMAIL_CHARSET, $html); + if (preg_match('/(\s+content=[\'"]\w+\/\w+;\s*charset)=([a-z0-9-]+)/i', $html)) + $html = preg_replace('/(\s+content=[\'"]\w+\/\w+;\s*charset)=([a-z0-9-]+)/i', '\\1='.RCMAIL_CHARSET, $html); else { // add <head> for malformed messages, washtml cannot work without that - if (!preg_match('/<head>(.*)<\/head>/m', $html)) + if (!preg_match('/<head>(.*)<\\/head>/Uims', $html)) $html = '<head></head>' . $html; $html = substr_replace($html, '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />', intval(stripos($html, '</head>')), 0); } - + // clean HTML with washhtml by Frederic Motte - $body = washtml::wash($html, array( + $wash_opts = array( 'show_washed' => false, - 'allow_remote' => $safe, + 'allow_remote' => $p['safe'], 'blocked_src' => "./program/blocked.gif", 'charset' => RCMAIL_CHARSET, 'cid_map' => $part->replaces, - ), $full_inline); - - $REMOTE_OBJECTS = !$full_inline; + 'html_elements' => array('body'), + ); + + if (!$p['inline_html']) { + $wash_opts['html_elements'] = array('html','head','title','body'); + } + + /* CSS styles need to be sanitized! + if ($p['safe']) { + $wash_opts['html_elements'][] = 'style'; + $wash_opts['html_attribs'] = array('type'); + } + */ + + $washer = new washtml($wash_opts); + $washer->add_callback('form', 'rcmail_washtml_callback'); + $body = $washer->wash($html); + $REMOTE_OBJECTS = $washer->extlinks; return $body; } @@ -637,21 +654,36 @@ function rcmail_print_body($part, $safe=false, $plain=false) $body = preg_replace("/##string_replacement\{([0-9]+)\}##/e", "\$replace_strings[\\1]", join("\n", $a_lines)); return "<div class=\"pre\">".$body."\n</div>"; - } - - +} /** * add a string to the replacement array and return a replacement string */ function rcmail_str_replacement($str, &$rep) - { +{ static $count = 0; $rep[$count] = stripslashes($str); return "##string_replacement{".($count++)."}##"; - } +} +/** + * Callback function for washtml cleaning class + */ +function rcmail_washtml_callback($tagname, $attrib, $content) +{ + switch ($tagname) { + case 'form': + $out = html::div('form', $content); + break; + + default: + $out = ''; + } + + return $out; +} + /** * return table with message headers @@ -756,7 +788,7 @@ function rcmail_message_body($attrib) if (!isset($part->body)) $part->body = $MESSAGE->get_part_content($part->mime_id); - $body = rcmail_print_body($part, $safe_mode, !$CONFIG['prefer_html']); + $body = rcmail_print_body($part, array('safe' => $safe_mode, 'plain' => !$CONFIG['prefer_html'])); if ($part->ctype_secondary == 'html') $out .= html::div('message-htmlpart', rcmail_html4inline($body, $attrib['id'])); diff --git a/program/steps/mail/get.inc b/program/steps/mail/get.inc index 4d7895269..842c60536 100644 --- a/program/steps/mail/get.inc +++ b/program/steps/mail/get.inc @@ -65,6 +65,8 @@ else if ($pid = get_input_value('_part', RCUBE_INPUT_GET)) { header("Cache-Control: private", false); header("Content-Type: application/octet-stream"); } + else if ($ctype_primary == 'text') + header("Content-Type: text/$ctype_secondary; charset=" . RCMAIL_CHARSET); else header("Content-Type: $mimetype"); @@ -95,7 +97,7 @@ else if ($pid = get_input_value('_part', RCUBE_INPUT_GET)) { $part->body = $MESSAGE->get_part_content($part->mime_id); $OUTPUT = new rcube_html_page(); - $OUTPUT->write(rcmail_print_body($part, $MESSAGE->is_safe)); + $OUTPUT->write(rcmail_print_body($part, array('safe' => $MESSAGE->is_safe, 'inline_html' => false))); } else { header(sprintf('Content-Disposition: %s; filename="%s";', |