mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 16:13:15 +00:00
dealerweb
3e58eb636c
ALLOWED_URI_REGEXP excludes image/svg+xml on purpose - DOMPurify cannot inspect the bytes inside a data: URI, so an SVG payload can carry <script>/<foreignObject> the surrounding sanitizer never sees. That exclusion never took effect on <img>, <video>, <audio>, <source> and <track>: DOMPurify's attribute check short-circuits on DATA_URI_TAGS before ALLOWED_URI_REGEXP is consulted, and that set can only be extended via ADD_DATA_URI_TAGS, never trimmed. Any data: URI reached those tags, including image/svg+xml and text/html; <a href> behaved as documented. Not a live script vector - browsers render SVG-in-<img> in secure static mode - but the sanitizer promised something it did not enforce, and the print window renders sanitized bodies without the iframe sandbox and CSP that otherwise back it up. restrictDataUriResourcesOnNode re-applies the raster allowlist on those tags, wired in through the existing afterSanitizeAttributes hooks. The blocked-external-image placeholder becomes a 1x1 GIF: it is set in the same hook pass, so an SVG placeholder would depend on hook order. The three viewer call sites that hand-rolled DOMPurify.sanitize(html, EMAIL_IFRAME_SANITIZE_CONFIG) now use sanitizeEmailHtmlForIframe, which is the same thing and picks up the guard automatically.