]> git.donarmstrong.com Git - roundcube.git/blob - debian/patches/dont-use-preg-e-option.patch
Fix a vulnerability in the use of preg_replace (Closes: #508628).
[roundcube.git] / debian / patches / dont-use-preg-e-option.patch
1 --- roundcube-0.2~alpha/program/lib/html2text.php       2008-04-12 15:54:45.000000000 +0200
2 +++ roundcube-0.2~alpha/program/lib/html2text.php       2008-12-13 14:21:44.000000000 +0100
3 @@ -99,6 +99,22 @@
4       */
5      var $width = 70;
6  
7 +    /** 
8 +        *  List of preg* regular expression patterns to search for 
9 +        *  and replace using callback function. 
10 +        * 
11 +        *  @var array $callback_search 
12 +        *  @access public 
13 +        */ 
14 +     var $callback_search = array( 
15 +        '/<(h)[123456][^>]*>(.*?)<\/h[123456]>/i', // H1 - H3 
16 +        '/<(b)[^>]*>(.*?)<\/b>/i',                 // <b> 
17 +        '/<(strong)[^>]*>(.*?)<\/strong>/i',       // <strong> 
18 +        '/<(a) [^>]*href=("|\')([^"\']+)\2[^>]*>(.*?)<\/a>/i', 
19 +                                                   // <a href=""> 
20 +        '/<(th)[^>]*>(.*?)<\/th>/i',               // <th> and </th> 
21 +    ); 
22 +
23      /**
24       *  List of preg* regular expression patterns to search for,
25       *  used in conjunction with $replace.
26 @@ -112,12 +128,8 @@
27          "/[\n\t]+/",                             // Newlines and tabs
28          '/<script[^>]*>.*?<\/script>/i',         // <script>s -- which strip_tags supposedly has problems with
29          //'/<!-- .* -->/',                         // Comments -- which strip_tags might have problem a with
30 -        '/<a [^>]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // <a href="">
31 -        '/<h[123][^>]*>(.+?)<\/h[123]>/ie',      // H1 - H3
32 -        '/<h[456][^>]*>(.+?)<\/h[456]>/ie',      // H4 - H6
33          '/<p[^>]*>/i',                           // <P>
34          '/<br[^>]*>/i',                          // <br>
35 -        '/<b[^>]*>(.+?)<\/b>/ie',                // <b>
36          '/<i[^>]*>(.+?)<\/i>/i',                 // <i>
37          '/(<ul[^>]*>|<\/ul>)/i',                 // <ul> and </ul>
38          '/(<ol[^>]*>|<\/ol>)/i',                 // <ol> and </ol>
39 @@ -126,7 +138,6 @@
40          '/(<table[^>]*>|<\/table>)/i',           // <table> and </table>
41          '/(<tr[^>]*>|<\/tr>)/i',                 // <tr> and </tr>
42          '/<td[^>]*>(.+?)<\/td>/i',               // <td> and </td>
43 -        '/<th[^>]*>(.+?)<\/th>/ie',              // <th> and </th>
44          '/&nbsp;/i',
45          '/&quot;/i',
46          '/&gt;/i',
47 @@ -161,12 +172,8 @@
48          ' ',                                    // Newlines and tabs
49          '',                                     // <script>s -- which strip_tags supposedly has problems with
50          //'',                                  // Comments -- which strip_tags might have problem a with
51 -        '$this->_build_link_list("\\2", "\\3")', // <a href="">
52 -        "strtoupper(\"\n\n\\1\n\n\")",          // H1 - H3
53 -        "ucwords(\"\n\n\\1\n\")",               // H4 - H6
54          "\n\n",                                 // <P>
55          "\n",                                   // <br>
56 -        'strtoupper("\\1")',                    // <b>
57          '_\\1_',                                // <i>
58          "\n\n",                                 // <ul> and </ul>
59          "\n\n",                                 // <ol> and </ol>
60 @@ -175,7 +182,6 @@
61          "\n\n",                                 // <table> and </table>
62          "\n",                                   // <tr> and </tr>
63          "\t\t\\1\n",                            // <td> and </td>
64 -        "strtoupper(\"\t\t\\1\n\")",            // <th> and </th>
65          ' ',
66          '"',
67          '>',
68 @@ -379,6 +385,7 @@
69  
70          // Run our defined search-and-replace
71          $text = preg_replace($this->search, $this->replace, $text);
72 +        $text = preg_replace_callback($this->callback_search, array('html2text', '_preg_callback'), $text);
73  
74          // Strip any other HTML tags
75          $text = strip_tags($text, $this->allowed_tags);
76 @@ -446,6 +453,44 @@
77                
78        return $display . ' [' . ($index+1) . ']';
79        }
80 +
81 +    /**
82 +     *  Callback function for preg_replace_callback use.
83 +     *
84 +     *  @param  array PREG matches
85 +     *  @return string
86 +     *  @access private
87 +     */
88 +    function _preg_callback($matches)
89 +    {
90 +               switch($matches[1])
91 +               {
92 +           case 'b':
93 +           case 'strong':
94 +                       return $this->_strtoupper($matches[2]);
95 +           case 'hr':
96 +               return $this->_strtoupper("\t\t". $matches[2] ."\n");
97 +           case 'h':
98 +                       return $this->_strtoupper("\n\n". $matches[2] ."\n\n");
99 +           case 'a':
100 +                       return $this->_build_link_list($matches[3], $matches[4]);
101 +        }
102 +    }
103 +    
104 +    /**
105 +     *  Strtoupper multibyte wrapper function
106 +     *
107 +     *  @param  string
108 +     *  @return string
109 +     *  @access private
110 +     */
111 +    function _strtoupper($str)
112 +    {
113 +               if (function_exists('mb_strtoupper'))
114 +           return mb_strtoupper($str);
115 +       else
116 +                       return strtoupper($str);
117 +    }
118  }
119  
120  ?>
121 \ Pas de fin de ligne à la fin du fichier.