From 786aa0725e28976bed5037814e01c44c90a551f5 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 13 Jan 2015 03:41:41 -0500
Subject: [PATCH] Fix XSS issue in style attribute handling (#1490227)
---
program/lib/Roundcube/rcube_washtml.php | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
index 4bf189e..e0cce68 100644
--- a/program/lib/Roundcube/rcube_washtml.php
+++ b/program/lib/Roundcube/rcube_washtml.php
@@ -244,8 +244,8 @@
$t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
}
else if ($key == 'style' && ($style = $this->wash_style($value))) {
- $quot = strpos($style, '"') !== false ? "'" : '"';
- $t .= ' style=' . $quot . $style . $quot;
+ // replace double quotes to prevent syntax error and XSS issues (#1490227)
+ $t .= ' style="' . str_replace('"', '"', $style) . '"';
}
else if ($key == 'background'
|| ($key == 'src' && preg_match('/^(img|source)$/i', $node->tagName))
--
Gitblit v1.9.1