fix(mail(html)): ban "javascript:" prefix in href, action and formaction

Alinto · Nov 15, 2021 · e99090b · e99090b
1 parent 92820db
commit e99090b
Showing 1 changed file with 7 additions and 8 deletions.
diff --git a/UI/MailPartViewers/UIxMailPartHTMLViewer.m b/UI/MailPartViewers/UIxMailPartHTMLViewer.m
@@ -487,9 +487,7 @@ - (void) startElement: (NSString *) _localName
             {
               skipAttribute = NO;
               name = [[_attributes nameAtIndex: count] lowercaseString];
-              if ([name hasPrefix: @"ON"])
-                skipAttribute = YES;
-              else if ([name isEqualToString: @"src"])
+              if ([name isEqualToString: @"src"])
                 {
                   value = [_attributes valueAtIndex: count];
                   if ([value hasPrefix: @"cid:"])
@@ -517,13 +515,14 @@ - (void) startElement: (NSString *) _localName
                   name = [NSString stringWithFormat: @"unsafe-%@", name];
                 }
               else if ([name isEqualToString: @"href"]
-                       || [name isEqualToString: @"action"])
+                       || [name isEqualToString: @"action"]
+                       || [name isEqualToString: @"formaction"])
                 {
-                  value = [_attributes valueAtIndex: count];
-                  skipAttribute = ([value rangeOfString: @"://"].location
-                                   == NSNotFound
+                  value = [[_attributes valueAtIndex: count] lowercaseString];
+                  skipAttribute = ([value rangeOfString: @"://"].location == NSNotFound
                                    && ![value hasPrefix: @"mailto:"]
-                                   && ![value hasPrefix: @"#"]);
+                                   && ![value hasPrefix: @"#"]) ||
+                    [value hasPrefix: @"javascript:"];
                   if (!skipAttribute)
                     [resultPart appendString: @" rel=\"noopener\""];
                 }