githubFork/roundcubemail.git

			@@ -96,7 +96,20 @@
			's', 'samp', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table',
			'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'wbr', 'img',
			// form elements
			'button', 'input', 'textarea', 'select', 'option', 'optgroup'
			'button', 'input', 'textarea', 'select', 'option', 'optgroup',
			// SVG
			'svg', 'altglyph', 'altglyphdef', 'altglyphitem', 'animate', 'animatecolor',
			'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc',
			'ellipse', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line',
			'lineargradient', 'marker', 'mask', 'mpath', 'path', 'pattern',
			'polygon', 'polyline', 'radialgradient', 'rect', 'set', 'stop', 'switch', 'symbol',
			'text', 'textpath', 'tref', 'tspan', 'use', 'view', 'vkern', 'filter',
			// SVG Filters
			'feblend', 'fecolormatrix', 'fecomponenttransfer', 'fecomposite',
			'feconvolvematrix', 'fediffuselighting', 'fedisplacementmap',
			'feflood', 'fefunca', 'fefuncb', 'fefuncg', 'fefuncr', 'fegaussianblur',
			'feimage', 'femerge', 'femergenode', 'femorphology', 'feoffset',
			'fespecularlighting', 'fetile', 'feturbulence',
			);

			/* Ignore these HTML tags and their content */
			@@ -110,13 +123,52 @@
			'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace',
			'cellborder', 'size', 'lang', 'dir', 'usemap', 'shape', 'media',
			// attributes of form elements
			'type', 'rows', 'cols', 'disabled', 'readonly', 'checked', 'multiple', 'value'
			'type', 'rows', 'cols', 'disabled', 'readonly', 'checked', 'multiple', 'value',
			// SVG
			'accent-height', 'accumulate', 'additivive', 'alignment-baseline',
			'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseprofile',
			'baseline-shift', 'begin', 'bias', 'by', 'clip', 'clip-path', 'clip-rule',
			'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile',
			'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction',
			'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity',
			'fill-rule', 'filter', 'flood-color', 'flood-opacity', 'font-family', 'font-size',
			'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight',
			'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform',
			'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints',
			'keysplines', 'keytimes', 'lengthadjust', 'letter-spacing', 'kernelmatrix',
			'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid',
			'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits',
			'maskunits', 'max', 'mask', 'mode', 'min', 'numoctaves', 'offset', 'operator',
			'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order',
			'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits',
			'points', 'preservealpha', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount',
			'repeatdur', 'restart', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant',
			'specularexponent', 'spreadmethod', 'stddeviation', 'stitchtiles', 'stop-color',
			'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap',
			'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width',
			'surfacescale', 'targetx', 'targety', 'transform', 'text-anchor', 'text-decoration',
			'text-rendering', 'textlength', 'u1', 'u2', 'unicode', 'values', 'viewbox',
			'visibility', 'vert-adv-y', 'version', 'vert-origin-x', 'vert-origin-y', 'word-spacing',
			'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2',
			'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan',
			// XML
			'xml:id', 'xlink:title'
			);

			/* Elements which could be empty and be returned in short form (<tag />) */
			static $void_elements = array('area', 'base', 'br', 'col', 'command', 'embed', 'hr',
			'img', 'input', 'keygen', 'link', 'meta', 'param', 'source', 'track', 'wbr'
			'img', 'input', 'keygen', 'link', 'meta', 'param', 'source', 'track', 'wbr',
			// SVG
			'altglyph', 'altglyphdef', 'altglyphitem', 'animate', 'animatecolor',
			'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc',
			'ellipse', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line',
			'lineargradient', 'marker', 'mask', 'mpath', 'path', 'pattern',
			'polygon', 'polyline', 'radialgradient', 'rect', 'set', 'stop', 'switch', 'symbol',
			'text', 'textpath', 'tref', 'tspan', 'use', 'view', 'vkern', 'filter',
			);

			/* Attributes that may contain insecure content */
			static $insecure_attribs = array('href', 'to', 'from');

			/* State for linked objects in HTML */
			public $extlinks = false;
			@@ -148,10 +200,11 @@
			*/
			public function __construct($p = array())
			{
			$this->_html_elements = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements) ;
			$this->_html_attribs = array_flip((array)$p['html_attribs']) + array_flip(self::$html_attribs);
			$this->_ignore_elements = array_flip((array)$p['ignore_elements']) + array_flip(self::$ignore_elements);
			$this->_void_elements = array_flip((array)$p['void_elements']) + array_flip(self::$void_elements);
			$this->_html_elements = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements);
			$this->_html_attribs = array_flip((array)$p['html_attribs']) + array_flip(self::$html_attribs);
			$this->_insecure_attribs = array_flip((array)$p['insecure_attribs']) + array_flip(self::$insecure_attribs);
			$this->_ignore_elements = array_flip((array)$p['ignore_elements']) + array_flip(self::$ignore_elements);
			$this->_void_elements = array_flip((array)$p['void_elements']) + array_flip(self::$void_elements);

			unset($p['html_elements'], $p['html_attribs'], $p['ignore_elements'], $p['void_elements']);

			@@ -171,7 +224,7 @@
			*/
			private function wash_style($style)
			{
			$s = '';
			$result = array();

			foreach (explode(';', $style) as $declaration) {
			if (preg_match('/^\s([a-z\-]+)\s:\s(.)\s*$/i', $declaration, $match)) {
			@@ -179,54 +232,48 @@
			$str = $match[2];
			$value = '';

			while (sizeof($str) > 0 &&
			preg_match('/^(url$\s[\'"]?([^\'"$])[\'"]?\s\)'./1,2*/
			'\|rgb$\s[0-9]+\s,\s[0-9]+\s,\s[0-9]+\s$'.
			'\|-?[0-9.]+\s*(em\|ex\|px\|cm\|mm\|in\|pt\|pc\|deg\|rad\|grad\|ms\|s\|hz\|khz\|%)?'.
			'\|#[0-9a-f]{3,6}'.
			'\|[a-z0-9"\', -]+'.
			')\s*/i', $str, $match)
			) {
			if ($match[2]) {
			if (($src = $this->config['cid_map'][$match[2]])
			\|\| ($src = $this->config['cid_map'][$this->config['base_url'].$match[2]])
			) {
			$value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
			}
			else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) {
			if ($this->config['allow_remote']) {
			$value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')';
			foreach ($this->explode_style($str) as $val) {
			if (preg_match('/^url\(/i', $val)) {
			if (preg_match('/^url$\s[\'"]?([^\'"$])[\'"]?\s*\)/iu', $val, $match)) {
			$url = $match[1];
			if (($src = $this->config['cid_map'][$url])
			\|\| ($src = $this->config['cid_map'][$this->config['base_url'].$url])
			) {
			$value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
			}
			else {
			$this->extlinks = true;
			else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $url, $m)) {
			if ($this->config['allow_remote']) {
			$value .= ' url('.htmlspecialchars($m[0], ENT_QUOTES).')';
			}
			else {
			$this->extlinks = true;
			}
			}
			}
			else if (preg_match('/^data:.+/i', $match[2])) { // RFC2397
			$value .= ' url('.htmlspecialchars($match[2], ENT_QUOTES).')';
			else if (preg_match('/^data:.+/i', $url)) { // RFC2397
			$value .= ' url('.htmlspecialchars($url, ENT_QUOTES).')';
			}
			}
			}
			else {
			else if (!preg_match('/^(behavior\|expression)/i', $val)) {
			// whitelist ?
			$value .= ' ' . $match[0];
			$value .= ' ' . $val;

			// #1488535: Fix size units, so width:800 would be changed to width:800px
			if (preg_match('/(left\|right\|top\|bottom\|width\|height)/i', $cssid)
			&& preg_match('/^[0-9]+$/', $match[0])
			if (preg_match('/^(left\|right\|top\|bottom\|width\|height)/i', $cssid)
			&& preg_match('/^[0-9]+$/', $val)
			) {
			$value .= 'px';
			}
			}

			$str = substr($str, strlen($match[0]));
			}

			if (isset($value[0])) {
			$s .= ($s?' ':'') . $cssid . ':' . $value . ';';
			$result[] = $cssid . ':' . $value;
			}
			}
			}

			return $s;
			return implode('; ', $result);
			}

			/**
			@@ -234,25 +281,29 @@
			*/
			private function wash_attribs($node)
			{
			$t = '';
			$t = '';
			$washed = '';

			foreach ($node->attributes as $key => $plop) {
			$key = strtolower($key);
			$value = $node->getAttribute($key);
			foreach ($node->attributes as $name => $attr) {
			$key = strtolower($name);
			$value = $attr->nodeValue;

			if (isset($this->_html_attribs[$key]) \|\|
			($key == 'href' && ($value = trim($value))
			(isset($this->_insecure_attribs[$key])
			&& ($value = trim($value))
			&& !preg_match('!^(javascript\|vbscript\|data:text)!i', $value)
			&& preg_match('!^([a-z][a-z0-9.+-]+:\|//\|#).+!i', $value))
			) {
			$t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
			$t .= ' ' . $attr->nodeName . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
			}
			else if ($key == 'style' && ($style = $this->wash_style($value))) {
			$quot = strpos($style, '"') !== false ? "'" : '"';
			$t .= ' style=' . $quot . $style . $quot;
			// replace double quotes to prevent syntax error and XSS issues (#1490227)
			$t .= ' style="' . str_replace('"', '"', $style) . '"';
			}
			else if ($key == 'background' \|\| ($key == 'src' && strtolower($node->tagName) == 'img')) { //check tagName anyway
			else if ($key == 'background' \|\| $key == 'href'
			\|\| ($key == 'src' && preg_match('/^(img\|source)$/i', $node->tagName))
			\|\| ($key == 'poster' && strtolower($node->tagName) == 'video')
			) {
			if (($src = $this->config['cid_map'][$value])
			\|\| ($src = $this->config['cid_map'][$this->config['base_url'].$value])
			) {
			@@ -274,7 +325,7 @@
			}
			}
			else {
			$washed .= ($washed ? ' ' : '') . $key;
			$washed .= ($washed ? ' ' : '') . $attr->nodeName;
			}
			}

			@@ -312,7 +363,7 @@
			$dump = '';

			do {
			switch($node->nodeType) {
			switch ($node->nodeType) {
			case XML_ELEMENT_NODE: //Check element
			$tagName = strtolower($node->tagName);
			if ($callback = $this->handlers[$tagName]) {
			@@ -321,8 +372,25 @@
			}
			else if (isset($this->_html_elements[$tagName])) {
			$content = $this->dumpHtml($node, $level);
			$dump .= '<' . $tagName . $this->wash_attribs($node) .
			($content === '' && isset($this->_void_elements[$tagName]) ? ' />' : ">$content</$tagName>");
			$dump .= '<' . $tagName;

			if ($tagName == 'svg') {
			$xpath = new DOMXPath($node->ownerDocument);
			foreach ($xpath->query('namespace::*') as $ns) {
			if ($ns->nodeName != 'xmlns:xml') {
			$dump .= ' ' . $ns->nodeName . '="' . $ns->nodeValue . '"';
			}
			}
			}

			$dump .= $this->wash_attribs($node);

			if ($content === '' && isset($this->_void_elements[$tagName])) {
			$dump .= ' />';
			}
			else {
			$dump .= ">$content</$tagName>";
			}
			}
			else if (isset($this->_ignore_elements[$tagName])) {
			$dump .= '<!-- ' . htmlspecialchars($tagName, ENT_QUOTES) . ' not allowed -->';
			@@ -344,14 +412,9 @@
			case XML_HTML_DOCUMENT_NODE:
			$dump .= $this->dumpHtml($node, $level);
			break;

			case XML_DOCUMENT_TYPE_NODE:
			break;

			default:
			$dump .= '<!-- node type ' . $node->nodeType . ' -->';
			}
			} while($node = $node->nextSibling);
			}
			while($node = $node->nextSibling);

			return $dump;
			}
			@@ -379,13 +442,17 @@
			// Detect max nesting level (for dumpHTML) (#1489110)
			$this->max_nesting_level = (int) @ini_get('xdebug.max_nesting_level');

			// SVG need to be parsed as XML
			$xml = stripos($html, '<svg') !== false \|\| stripos($html, '<?xml') !== false;
			$method = $xml ? 'loadXML' : 'loadHTML';
			$options = 0;

			// Use optimizations if supported
			if (version_compare(PHP_VERSION, '5.4.0', '>=')) {
			@$node->loadHTML($html, LIBXML_PARSEHUGE \| LIBXML_COMPACT);
			if (PHP_VERSION_ID >= 50400) {
			$options = LIBXML_PARSEHUGE \| LIBXML_COMPACT \| LIBXML_NONET;
			}
			else {
			@$node->loadHTML($html);
			}

			@$node->{$method}($html, $options);

			return $this->dumpHtml($node);
			}
			@@ -403,6 +470,8 @@
			*/
			private function cleanup($html)
			{
			$html = trim($html);

			// special replacements (not properly handled by washtml class)
			$html_search = array(
			'/(<\/nobr>)(\s+)(<nobr>)/i', // space(s) between <NOBR>
			@@ -417,17 +486,19 @@
			'',
			'<html>',
			);

			$html = preg_replace($html_search, $html_replace, trim($html));

			//-> Replace all of those weird MS Word quotes and other high characters
			// Replace all of those weird MS Word quotes and other high characters
			$badwordchars = array(
			"\xe2\x80\x98", // left single quote
			"\xe2\x80\x99", // right single quote
			"\xe2\x80\x9c", // left double quote
			"\xe2\x80\x9d", // right double quote
			"\xe2\x80\x94", // em dash
			"\xe2\x80\xa6" // elipses
			"\xe2\x80\xa6" // elipses
			);

			$fixedwordchars = array(
			"'",
			"'",
			@@ -436,6 +507,7 @@
			'—',
			'...'
			);

			$html = str_replace($badwordchars, $fixedwordchars, $html);

			// PCRE errors handling (#1486856), should we use something like for every preg_* use?
			@@ -462,7 +534,7 @@
			// Remove invalid HTML comments (#1487759)
			// Don't remove valid conditional comments
			// Don't remove MSOutlook (<!-->) conditional comments (#1489004)
			$html = preg_replace('/<!--[^->\[\n]+>/', '', $html);
			$html = preg_replace('/<!--[^-<>\[\n]+>/', '', $html);

			// fix broken nested lists
			self::fix_broken_lists($html);
			@@ -481,7 +553,7 @@
			$tagname = $matches[2];
			$tagname = preg_replace(array(
			'/:.*$/', // Microsoft's Smart Tags <st1:xxxx>
			'/[^a-z0-9_\[\]\!-]/i', // forbidden characters
			'/[^a-z0-9_\[\]\!?-]/i', // forbidden characters
			), '', $tagname);

			// fix invalid closing tags - remove any attributes (#1489446)
			@@ -578,4 +650,49 @@
			}
			}
			}

			/**
			* Explode css style value
			*/
			protected function explode_style($style)
			{
			$style = trim($style);

			// first remove comments
			$pos = 0;
			while (($pos = strpos($style, '/*', $pos)) !== false) {
			$end = strpos($style, '*/', $pos+2);

			if ($end === false) {
			$style = substr($style, 0, $pos);
			}
			else {
			$style = substr_replace($style, '', $pos, $end - $pos + 2);
			}
			}

			$strlen = strlen($style);
			$result = array();

			// explode value
			for ($p=$i=0; $i < $strlen; $i++) {
			if (($style[$i] == "\"" \|\| $style[$i] == "'") && $style[$i-1] != "\\") {
			if ($q == $style[$i]) {
			$q = false;
			}
			else if (!$q) {
			$q = $style[$i];
			}
			}

			if (!$q && $style[$i] == ' ' && !preg_match('/[,\(]/', $style[$i-1])) {
			$result[] = substr($style, $p, $i - $p);
			$p = $i + 1;
			}
			}

			$result[] = (string) substr($style, $p);

			return $result;
			}
			}