amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-02-25 19:26:24 +00:00
Code Issues Projects Releases Wiki Activity

fix(mail(html)): ban "javascript:" prefix in href, action and formaction

Browse Source
This commit is contained in:
Francis Lachapelle
2022-04-04 16:17:15 -04:00
parent f38eded701
commit dd7dd49641
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
UI/MailPartViewers/UIxMailPartHTMLViewer.m
View File

@@ -299,7 +299,7 @@ _xmlCharsetForCharset (NSString *charset)
attributes: (id <SaxAttributes>) _attributes
{
unsigned int count, max;
NSString *name, *value, *cid, *lowerName;
NSString *name, *value, *cid, *lowerName, *lowerValue;
NSMutableString *resultPart;
BOOL skipAttribute;
@@ -371,13 +371,19 @@ _xmlCharsetForCharset (NSString *charset)
name = [NSString stringWithFormat: @"unsafe-%@", name];
}
else if ([name isEqualToString: @"href"]
|| [name isEqualToString: @"action"])
|| [name isEqualToString: @"action"]
|| [name isEqualToString: @"formaction"])
{
value = [_attributes valueAtIndex: count];
skipAttribute = ([value rangeOfString: @"://"].location
== NSNotFound
&& ![value hasPrefix: @"mailto:"]
&& ![value hasPrefix: @"#"]);
lowerValue = [[value lowercaseString] stringByReplacingString: @"\""
withString: @""];
skipAttribute =
([lowerValue rangeOfString: @"://"].location == NSNotFound
&& ![lowerValue hasPrefix: @"mailto:"]
&& ![lowerValue hasPrefix: @"#"])
|| [lowerValue rangeOfString: @"javascript:"].location != NSNotFound;
if (!skipAttribute)
[resultPart appendString: @" rel=\"noopener\""];
}
// Avoid: <div style="background:url('http://www.sogo.nu/fileadmin/sogo/logos/sogo.bts.png' ); width: 200px; height: 200px;" title="ssss">
else if ([name isEqualToString: @"style"])