+ $attvalue = "idiocy"; + $attary{$attname} = $attvalue; + } + sq_unspace($attvalue); /** * Now let's run checks on the attvalues. @@ -1299,20 +1843,39 @@ function sq_fixatts($tagname, * Second one is replacements */ list($valmatch, $valrepl) = $valary; - $newvalue = + $newvalue = preg_replace($valmatch, $valrepl, $attvalue); if ($newvalue != $attvalue){ $attary{$attname} = $newvalue; + $attvalue = $newvalue; } } } } } + if ($attname == 'style') { + if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) { + // 8bit and control characters in style attribute values can be used for XSS, remove them + $attary{$attname} = '"disallowed character"'; + } + preg_match_all("/url\s*$(.+)$/si",$attvalue,$aMatch); + if (count($aMatch)) { + foreach($aMatch[1] as $sMatch) { + // url value + $urlvalue = $sMatch; + sq_fix_url($attname, $urlvalue, $message, $id, $mailbox,"'"); + $attary{$attname} = str_replace($sMatch,$urlvalue,$attvalue); + } + } + } /** - * Turn cid: urls into http-friendly ones. + * Use white list based filtering on attributes which can contain url's */ - if (preg_match("/^[\'\"]\s*cid:/si", $attvalue)){ - $attary{$attname} = sq_cid2http($message, $id, $attvalue, $mailbox); + else if ($attname == 'href' || $attname == 'xlink:href' || $attname == 'src' + || $attname == 'poster' || $attname == 'formaction' + || $attname == 'background' || $attname == 'action') { + sq_fix_url($attname, $attvalue, $message, $id, $mailbox); + $attary{$attname} = $attvalue; } } /** @@ -1326,18 +1889,235 @@ function sq_fixatts($tagname, return $attary; } +/** + * This function filters url's + * + * @param $attvalue String with attribute value to filter + * @param $message message object + * @param $id message id + * @param $mailbox mailbox + * @param $sQuote quoting characters around url's + */ +function sq_fix_url($attname, &$attvalue, $message, $id, $mailbox,$sQuote = '"') { + $attvalue = trim($attvalue); + if ($attvalue && ($attvalue[0] =='"'|| $attvalue[0] == "'")) { + // remove the double quotes + $sQuote = $attvalue[0]; + $attvalue = trim(substr($attvalue,1,-1)); + } + + // If there's no "view_unsafe_images" variable in the URL, turn unsafe + // images off by default. + sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET, FALSE); + + global $use_transparent_security_image; + if ($use_transparent_security_image) $secremoveimg = '../images/spacer.png'; + else $secremoveimg = '../images/' . _("sec_remove_eng.png"); + + /** + * Replace empty src tags with the blank image. src is only used + * for frames, images, and image inputs. Doing a replace should + * not affect them working as should be, however it will stop + * IE from being kicked off when src for img tags are not set + */ + if ($attvalue == '') { + $attvalue = '"' . SM_PATH . 'images/blank.png"'; + } else { + // first, disallow 8 bit characters and control characters + if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) { + switch ($attname) { + case 'href': + $attvalue = $sQuote . 'http://invalid-stuff-detected.example.com' . $sQuote; + break; + default: + $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote; + break; + } + } else { + $aUrl = parse_url($attvalue); + if (isset($aUrl['scheme'])) { + switch(strtolower($aUrl['scheme'])) { + case 'mailto': + case 'http': + case 'https': + case 'ftp': + if ($attname != 'href') { + if ($view_unsafe_images == false) { + $attvalue = $sQuote . $secremoveimg . $sQuote; + } else { + if (isset($aUrl['path'])) { + + // No one has been able to show that image URIs + // can be exploited, so for now, no restrictions + // are made at all. If this proves to be a problem, + // the commented-out code below can be of help. + // (One consideration is that I see nothing in this + // function that specifically says that we will + // only ever arrive here when inspecting an image + // tag, although that does seem to be the end + // result - e.g.,

' . - _("Body retrieval error. The reason for this is most probably that the message is malformed.") . - '
' . _("Command:") . "	$cmd
' . _("Response:") . "	$response
' . _("Message:") . "	$message
' . _("FETCH line:") . "	$topline

' . + _("Body retrieval error. The reason for this is most probably that the message is malformed.") . + '
' . _("Command:") . "	$cmd
' . _("Response:") . "	$response
' . _("Message:") . "	$message
' . _("FETCH line:") . "	$topline