Skip to content

Commit 43aaaa5

Browse files
alecplalecpl
committed
Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
Reported by Valentin T. and Lutz Wolf of CrowdStrike.
1 parent cde4522 commit 43aaaa5

3 files changed

Lines changed: 6 additions & 1 deletion

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
- Fix missing field labels in CSV import, for some locales (#9393)
1010
- Fix command injection via crafted im_convert_path/im_identify_path on Windows
1111
- Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
12+
- Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
1213

1314
## Release 1.6.6
1415

‎program/lib/Roundcube/rcube_washtml.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -541,7 +541,7 @@ private static function attribute_value($node, $attr_name, $attr_value)
541541

542542
foreach ($node->attributes as $name => $attr) {
543543
if (strtolower($name) === $attr_name) {
544-
if (strtolower($attr_value) === strtolower($attr->nodeValue)) {
544+
if (strtolower($attr_value) === strtolower(trim($attr->nodeValue))) {
545545
return true;
546546
}
547547
}

‎tests/Framework/Washtml.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -473,6 +473,10 @@ function data_wash_svg_tests()
473473
. 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>',
474474
'<svg><use x-washed="href"></use></svg>'
475475
],
476+
[
477+
'<html><svg><animate attributeName="href " values="javascript:alert(\'XSS\')" href="#link" /></animate></svg></html>',
478+
'<svg><!-- animate blocked --></svg>',
479+
],
476480
];
477481
}
478482

0 commit comments

Comments
 (0)