summaryrefslogtreecommitdiff
path: root/program
diff options
context:
space:
mode:
Diffstat (limited to 'program')
-rw-r--r--program/lib/Roundcube/rcube_string_replacer.php13
-rw-r--r--program/steps/mail/func.inc14
2 files changed, 18 insertions, 9 deletions
diff --git a/program/lib/Roundcube/rcube_string_replacer.php b/program/lib/Roundcube/rcube_string_replacer.php
index 49a378166..b8768bc98 100644
--- a/program/lib/Roundcube/rcube_string_replacer.php
+++ b/program/lib/Roundcube/rcube_string_replacer.php
@@ -28,9 +28,10 @@ class rcube_string_replacer
public $mailto_pattern;
public $link_pattern;
private $values = array();
+ private $options = array();
- function __construct()
+ function __construct($options = array())
{
// Simplified domain expression for UTF8 characters handling
// Support unicode/punycode in top-level domain part
@@ -44,6 +45,8 @@ class rcube_string_replacer
."@$utf_domain" // domain-part
."(\?[$url1$url2]+)?" // e.g. ?subject=test...
.")/";
+
+ $this->options = $options;
}
/**
@@ -89,10 +92,10 @@ class rcube_string_replacer
if ($url) {
$suffix = $this->parse_url_brackets($url);
- $i = $this->add($prefix . html::a(array(
- 'href' => $url_prefix . $url,
- 'target' => '_blank'
- ), rcube::Q($url)) . $suffix);
+ $attrib = (array)$this->options['link_attribs'];
+ $attrib['href'] = $url_prefix . $url;
+
+ $i = $this->add($prefix . html::a($attrib, rcube::Q($url)) . $suffix);
}
// Return valid link for recognized schemes, otherwise
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 8c9743949..274c40b5c 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -760,7 +760,8 @@ function rcmail_plain_body($body, $flowed=false)
global $RCMAIL;
// make links and email-addresses clickable
- $replacer = new rcmail_string_replacer;
+ $attribs = array('link_attribs' => array('rel' => 'noreferrer', 'target' => '_blank'));
+ $replacer = new rcmail_string_replacer($attribs);
// search for patterns like links and e-mail addresses and replace with tokens
$body = $replacer->replace($body);
@@ -1373,7 +1374,7 @@ function rcmail_html4inline($body, $container_id, $body_id='', &$attributes=null
/**
- * parse link attributes and set correct target
+ * parse link (a, link, area) attributes and set correct target
*/
function rcmail_alter_html_link($matches)
{
@@ -1382,9 +1383,9 @@ function rcmail_alter_html_link($matches)
// Support unicode/punycode in top-level domain part
$EMAIL_PATTERN = '([a-z0-9][a-z0-9\-\.\+\_]*@[^&@"\'.][^@&"\']*\\.([^\\x00-\\x40\\x5b-\\x60\\x7b-\\x7f]{2,}|xn--[a-z0-9]{2,}))';
- $tag = $matches[1];
+ $tag = strtolower($matches[1]);
$attrib = parse_attrib_string($matches[2]);
- $end = '>';
+ $end = '>';
// Remove non-printable characters in URL (#1487805)
if ($attrib['href'])
@@ -1411,6 +1412,11 @@ function rcmail_alter_html_link($matches)
$attrib['target'] = '_blank';
}
+ // Better security by adding rel="noreferrer" (#1484686)
+ if (($tag == 'a' || $tag == 'area') && $attrib['href'] && $attrib['href'][0] != '#') {
+ $attrib['rel'] = 'noreferrer';
+ }
+
// allowed attributes for a|link|area tags
$allow = array('href','name','target','onclick','id','class','style','title',
'rel','type','media','alt','coords','nohref','hreflang','shape');