kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

mail/rainloop: Add patch to fix cross-site-scripting (XSS) vulnerability

Browse source 
PR:		263749
Reported by:	Lapo Luchini
Obtained from:	https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw
MFH:		2022Q2
Security:	a8118db0-cac2-11ec-9288-0800270512f4
This commit is contained in:
Yasuhiro Kimura 2022-05-03 19:06:33 +09:00
parent d9b2c35e30
commit f9f524f160
2 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
mail/rainloop/Makefile
View file

@ -1,6 +1,6 @@
PORTNAME= rainloop
DISTVERSION= 1.16.0
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= mail www
MASTER_SITES= https://github.com/RainLoop/rainloop-webmail/releases/download/v${PORTVERSION}/
PKGNAMESUFFIX?= ${PHP_PKGNAMESUFFIX}

21
mail/rainloop/files/patch-rainloop_v_1.16.0_app_libraries_MailSo_Base_HtmlUtils.php Normal file
View file

@ -0,0 +1,21 @@
--- rainloop/v/1.16.0/app/libraries/MailSo/Base/HtmlUtils.php.orig 2021-05-06 11:04:36 UTC
+++ rainloop/v/1.16.0/app/libraries/MailSo/Base/HtmlUtils.php
@@ -239,7 +239,8 @@ class HtmlUtils
$oWrapHtml->setAttribute($sKey, $sValue);
}
- $oWrapDom = $oDom->createElement('div', '___xxx___');
+ $rand_str = base64_encode(random_bytes(32));
+ $oWrapDom = $oDom->createElement('div', $rand_str);
$oWrapDom->setAttribute('data-x-div-type', 'body');
foreach ($aBodylAttrs as $sKey => $sValue)
{
@@ -250,7 +251,7 @@ class HtmlUtils
$sWrp = $oDom->saveHTML($oWrapHtml);
- $sResult = \str_replace('___xxx___', $sResult, $sWrp);
+ $sResult = \str_replace($rand_str, $sResult, $sWrp);
}
$sResult = \str_replace(\MailSo\Base\HtmlUtils::$KOS, ':', $sResult);