From 786aa0725e28976bed5037814e01c44c90a551f5 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Tue, 13 Jan 2015 09:41:41 +0100 Subject: Fix XSS issue in style attribute handling (#1490227) --- program/lib/Roundcube/rcube_washtml.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'program/lib/Roundcube') diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php index 4bf189e99..e0cce685b 100644 --- a/program/lib/Roundcube/rcube_washtml.php +++ b/program/lib/Roundcube/rcube_washtml.php @@ -244,8 +244,8 @@ class rcube_washtml $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; } else if ($key == 'style' && ($style = $this->wash_style($value))) { - $quot = strpos($style, '"') !== false ? "'" : '"'; - $t .= ' style=' . $quot . $style . $quot; + // replace double quotes to prevent syntax error and XSS issues (#1490227) + $t .= ' style="' . str_replace('"', '"', $style) . '"'; } else if ($key == 'background' || ($key == 'src' && preg_match('/^(img|source)$/i', $node->tagName)) -- cgit v1.2.3