Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 10:09:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Security fixes

Browse source
This commit is contained in:
RainLoop Team 2014-07-02 17:11:43 +04:00
parent 12a2f324b2
commit 34ab65fc80
3 changed files with 33 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

16
rainloop/v/0.0.0/app/libraries/MailSo/Base/HtmlUtils.php
View file

@ -437,6 +437,17 @@ class HtmlUtils
\MailSo\Base\HtmlUtils::FindLinksInDOM($oDom);
}
$aNodes = $oDom->getElementsByTagName('*');
foreach ($aNodes as /* @var $oElement \DOMElement */ $oElement)
{
if (\in_array(\strtolower($oElement->tagName), array('svg', 'head', 'link',
'base', 'meta', 'title', 'style', 'script', 'bgsound', 'keygen', 'source',
'object', 'embed', 'applet', 'mocha', 'iframe', 'frame', 'frameset', 'video', 'audio')) && isset($oElement->parentNode))
{
@$oElement->parentNode->removeChild($oElement);
}
}
$aNodes = $oDom->getElementsByTagName('*');
foreach ($aNodes as /* @var $oElement \DOMElement */ $oElement)
{
@ -524,7 +535,8 @@ class HtmlUtils
// }
foreach (array(
'id', 'class', 'contenteditable', 'designmode', 'formaction', 'data-bind', 'xmlns'
'id', 'class', 'contenteditable', 'designmode', 'formaction', 'data-bind', 'xmlns',
'srcset'
) as $sAttr)
{
@$oElement->removeAttribute($sAttr);
@ -552,6 +564,8 @@ class HtmlUtils
if ($oElement->hasAttribute('src'))
{
// file_put_contents('f:/fff', $oElement->getAttribute('src')."\r\n", FILE_APPEND);
$sSrc = \trim($oElement->getAttribute('src'));
$oElement->removeAttribute('src');