From 280395a544fa1822ee620ce38f361f7cf8185091 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 15 Oct 2015 03:10:36 -0400
Subject: [PATCH] Fix bug where HTML messages with invalid/excessive css styles couldn't be displayed (#1490539)
---
CHANGELOG | 1 +
program/steps/mail/func.inc | 7 +++++++
2 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 14c2d56..519922d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -6,6 +6,7 @@
- Fix so database_attachments::cleanup() does not remove attachments from other sessions (#1490542)
- Fix responses list update issue after response name change (#1490555)
- Fix bug where message preview was unintentionally reset on check-recent action (#1490563)
+- Fix bug where HTML messages with invalid/excessive css styles couldn't be displayed (#1490539)
RELEASE 1.1.3
-------------
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index d432a00..8cb1e8e 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -948,6 +948,13 @@
break;
case 'style':
+ // Crazy big styles may freeze the browser (#1490539)
+ // remove content with more than 5k lines
+ if (substr_count($content, "\n") > 5000) {
+ $out = '';
+ break;
+ }
+
// decode all escaped entities and reduce to ascii strings
$stripped = preg_replace('/[^a-zA-Z\(:;]/', '', rcube_utils::xss_entity_decode($content));
--
Gitblit v1.9.1