Fix bug where image data URIs in css style were treated as evil/remot…

…e in mail preview (#5580)
roundcube · Jan 7, 2017 · 7340360 · 7340360
1 parent f65f4bb
commit 7340360
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 2 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,6 +1,8 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix bug where image data URIs in css style were treated as evil/remote in mail preview (#5580)
+
 RELEASE 1.3-beta
 ----------------
 - Nicely handle contact deletion on contact edit (#5522)

diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
@@ -391,7 +391,7 @@ public static function mod_css_styles($source, $container_id, $allow_remote = fa
         // ignore the whole block if evil styles are detected
         $source   = self::xss_entity_decode($source);
         $stripped = preg_replace('/[^a-z\(:;]/i', '', $source);
-        $evilexpr = 'expression|behavior|javascript:|import[^a]' . (!$allow_remote ? '|url\(' : '');
+        $evilexpr = 'expression|behavior|javascript:|import[^a]' . (!$allow_remote ? '|url\((?!data:image)' : '');
 
         if (preg_match("/$evilexpr/i", $stripped)) {
             return '/* evil! */';

diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
@@ -1006,7 +1006,7 @@ function rcmail_washtml_callback($tagname, $attrib, $content, $washtml)
 
         // now check for evil strings like expression, behavior or url()
         if (!preg_match('/expression|behavior|javascript:|import[^a]/i', $stripped)) {
-            if (!$washtml->get_config('allow_remote') && stripos($stripped, 'url(')) {
+            if (!$washtml->get_config('allow_remote') && preg_match('/url\((?!data:image)/', $stripped)) {
                 $washtml->extlinks = true;
             }
             else {

diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
@@ -214,6 +214,10 @@ function test_mod_css_styles_xss()
 
         $mod = rcube_utils::mod_css_styles(".test { position:/**/fixed; }", 'rcmbody');
         $this->assertEquals("#rcmbody .test { position: absolute; }", $mod, "Replace position:fixed with position:absolute (2)");
+
+        // allow data URIs with images (#5580)
+        $mod = rcube_utils::mod_css_styles("body { background-image: url(data:image/png;base64,123); }", 'rcmbody');
+        $this->assertEquals("#rcmbody { background-image: url(data:image/png;base64,123); }", $mod, "Data URIs in url() allowed");
     }
 
     /**