Commit Graph
12 Commits
Author SHA1 Message Date
Jan Kahmen 8813677ecb fix(core): keep the @import cleanup working in stringWithoutHTMLInjection
the trailing while loop reuses the regex variable, which by then points at the
angular brace pattern whenever stripAngular is YES. that pattern has two
capture groups while the loop substitutes $1@im****$3, so NSRegularExpression
raises NSInvalidArgumentException and the NS_HANDLER swallows it.

give the @import pattern its own variable and use it in both the replacement
and the loop. the replacement also used the template of the block above, which
dropped the whole style element instead of masking the @import in place, so
test_stringWithoutHTMLInjection failed. it passes again, and a case with
stripAngular YES covers the loop.
2026-08-17 23:03:41 +02:00
Hivert Quentin 1caa25711f fix(bug): incorrect method called 2026-08-11 17:06:27 +02:00
Hivert Quentin c45233c11e fix(pref): prevent onevent cleaning to remove legitimate words 2026-05-19 09:30:58 +02:00
Jordi MallachandQHivert e27b083213 Update onEvent test to match expectation after the XSS fixes 2026-05-12 13:19:09 +02:00
smizrahi 455fe97cbe feat(core): Add message of the day. Remove all html tags except for anchor tags (mobile only) 2024-01-29 17:16:08 +01:00
smizrahi 2146870071 fix(mail): Fix security @import css injection 2024-01-23 15:01:47 +00:00
Hivert Quentin 7481ccf370 fix(hmtl): prevent html injection of tag form 2023-11-06 14:04:53 +01:00
smizrahi f9fdad251d fix(mail): Removed invalid HTML tags in mail body. Fixes #5755 2023-06-07 14:42:21 +02:00
smizrahi b1f84891b0 fix(security): Security fix for WSTG-INPV-02. Add unit test. 2022-11-23 09:34:54 +01:00
Ludovic Marcotte b3bc6bb7dc Applied changes coming from v2/PR#184. 2016-01-18 09:26:07 -05:00
Wolfgang Sourdeau 6aa627a800 Monotone-Parent: 2fb9aaf01f9b4a29e3d49d6c35deaf48a4e57e9c
Monotone-Revision: 825d6255230167e6f80d8015a569afa6bdb4cb7d

Monotone-Author: wsourdeau@inverse.ca
Monotone-Date: 2012-04-16T15:24:16
2012-04-16 15:24:16 +00:00
Wolfgang Sourdeau 5f6f472b16 Monotone-Parent: 3049bbd9ddfe5886523c3f742888bf850719f4bc
Monotone-Revision: d9a86eb13b216d79e4554381c163dbca408f0d39

Monotone-Author: wsourdeau@inverse.ca
Monotone-Date: 2011-07-19T20:01:13
Monotone-Branch: ca.inverse.sogo
2011-07-19 20:01:13 +00:00