Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 10:09:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Security fixes

Browse source
This commit is contained in:
RainLoop Team 2014-07-02 17:11:43 +04:00
parent 12a2f324b2
commit 34ab65fc80
3 changed files with 33 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

16
rainloop/v/0.0.0/app/libraries/MailSo/Base/HtmlUtils.php
View file

@ -437,6 +437,17 @@ class HtmlUtils
\MailSo\Base\HtmlUtils::FindLinksInDOM($oDom); \MailSo\Base\HtmlUtils::FindLinksInDOM($oDom);
} }
$aNodes = $oDom->getElementsByTagName('*');
foreach ($aNodes as /* @var $oElement \DOMElement */ $oElement)
{
if (\in_array(\strtolower($oElement->tagName), array('svg', 'head', 'link',
'base', 'meta', 'title', 'style', 'script', 'bgsound', 'keygen', 'source',
'object', 'embed', 'applet', 'mocha', 'iframe', 'frame', 'frameset', 'video', 'audio')) && isset($oElement->parentNode))
{
@$oElement->parentNode->removeChild($oElement);
}
}
$aNodes = $oDom->getElementsByTagName('*'); $aNodes = $oDom->getElementsByTagName('*');
foreach ($aNodes as /* @var $oElement \DOMElement */ $oElement) foreach ($aNodes as /* @var $oElement \DOMElement */ $oElement)
{ {
@ -524,7 +535,8 @@ class HtmlUtils
// } // }
foreach (array( foreach (array(
'id', 'class', 'contenteditable', 'designmode', 'formaction', 'data-bind', 'xmlns' 'id', 'class', 'contenteditable', 'designmode', 'formaction', 'data-bind', 'xmlns',
'srcset'
) as $sAttr) ) as $sAttr)
{ {
@$oElement->removeAttribute($sAttr); @$oElement->removeAttribute($sAttr);
@ -552,6 +564,8 @@ class HtmlUtils
if ($oElement->hasAttribute('src')) if ($oElement->hasAttribute('src'))
{ {
// file_put_contents('f:/fff', $oElement->getAttribute('src')."\r\n", FILE_APPEND);
$sSrc = \trim($oElement->getAttribute('src')); $sSrc = \trim($oElement->getAttribute('src'));
$oElement->removeAttribute('src'); $oElement->removeAttribute('src');

15
rainloop/v/0.0.0/app/libraries/MailSo/Base/Utils.php
View file

@ -1043,8 +1043,19 @@ class Utils
*/ */
public static function ClearFileName($sFileName) public static function ClearFileName($sFileName)
{ {
return \preg_replace('/[\s]+/', ' ', return \MailSo\Base\Utils::ClearNullBite(\preg_replace('/[\s]+/', ' ',
\str_replace(array('"', '/', '\\', '*', '?', '<', '>', '|', ':'), ' ', $sFileName)); \str_replace(array('"', '/', '\\', '*', '?', '<', '>', '|', ':'), ' ', $sFileName)));
}
/**
* @param string $sValue
*
* @return string
*/
public static function ClearXss($sValue)
{
return \MailSo\Base\Utils::ClearNullBite(
\str_replace(array('"', '/', '\\', '*', '?', '<', '>', '|', ':'), ' ', $sValue));
} }
/** /**

7
rainloop/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -6992,9 +6992,11 @@ class Actions
'Folder' => $mResult['Folder'], 'Folder' => $mResult['Folder'],
'Uid' => $mResult['Uid'], 'Uid' => $mResult['Uid'],
'MimeType' => 'message/rfc822', 'MimeType' => 'message/rfc822',
'FileName' => (0 === \strlen($sSubject) ? 'message-'.$mResult['Uid'] : $sSubject).'.eml' 'FileName' => (0 === \strlen($sSubject) ? 'message-'.$mResult['Uid'] : \MailSo\Base\Utils::ClearXss($sSubject)).'.eml'
)); ));
// Flags // Flags
$aFlags = $mResponse->FlagsLowerCase(); $aFlags = $mResponse->FlagsLowerCase();
$mResult['IsSeen'] = \in_array('\\seen', $aFlags); $mResult['IsSeen'] = \in_array('\\seen', $aFlags);
@ -7177,7 +7179,8 @@ class Actions
'Uid' => (string) $mResponse->Uid(), 'Uid' => (string) $mResponse->Uid(),
'MimeIndex' => (string) $mResponse->MimeIndex(), 'MimeIndex' => (string) $mResponse->MimeIndex(),
'MimeType' => $mResponse->MimeType(), 'MimeType' => $mResponse->MimeType(),
'FileName' => $mResponse->FileName(true), 'FileName' => \MailSo\Base\Utils::ClearFileName(
\MailSo\Base\Utils::ClearXss($mResponse->FileName(true))),
'EstimatedSize' => $mResponse->EstimatedSize(), 'EstimatedSize' => $mResponse->EstimatedSize(),
'CID' => $mResponse->Cid(), 'CID' => $mResponse->Cid(),
'ContentLocation' => $mResponse->ContentLocation(), 'ContentLocation' => $mResponse->ContentLocation(),