[imp] IMP XSS bug #2

[Ulf Harnhammar]

Hello!

I have found two more Cross-Site Scripting problems in IMP's HTML mail display
system:


** EXAMPLE #1 **
(the entities for "script:" don't allow for upper case letters)


<frameset rows="1,*">
<frame src="jav&#x41;s&#x43;rip&#84;:alert(57)">
<frame src="http://www.horde.org/imp/">
</frameset>


** EXAMPLE #2 **
(numeric entities wrap over after 2 ** 32)
(works on Mozilla, Galeon and Opera - but not on Internet Explorer)


<frameset rows="1,*">
<frame src="jav&#x41;s&#x43;rip&#84;&#4294967354;alert(57)">
<frame src="http://www.horde.org/imp/">
</frameset>


The attached patch (against the 3.2.1 release) should fix these problems.


// Ulf Harnhammar

-------------- next part --------------
--- imp-3.2.1/lib/MIME/Viewer/html.php.orig	2003-08-01 19:58:51.000000000 +0200
+++ imp-3.2.1/lib/MIME/Viewer/html.php	2003-08-01 20:03:27.000000000 +0200
@@ -68,10 +68,22 @@
         // authors: always use the semicolon.)
         $data = preg_replace('/&#0*(9|1[0-3])([^0-9]|$)/i', '&nbsp\\2', $data);
 
+        /* Remove overly long numeric entities. */
+        $data = preg_replace('/&#x?0*[0-9A-F]{6,};?/i', '&nbsp;', $data);
+
         /* Get all attribute="javascript:foo()" tags. */
         /* This is essentially the regex /=("?)[^>]*script:/ but expanded */
         /* to catch camouflage with spaces and entities. */
-        $preg = '/(&#0*61;?|&#x0*3D;?|=)\s*(&#0*34;?|&#x0*22;?|")?[^>]*\s*(&#0*115;?|&#x0*73;?|s)\s*(&#0*99;?|&#x0*63;?|c)\s*(&#0*114;?|&#x0*72;?|r)\s*(&#0*105;?|&#x0*69;?|i)\s*(&#0*112;?|&#x0*70;?|p)\s*(&#0*116;?|&#x0*74;?|t)\s*(&#0*58;?|&#x0*3A;?|:)/i';
+        $preg = '/(&#0*61;?|&#x0*3D;?|=)\s*'.
+                '(&#0*34;?|&#x0*22;?|")?'.
+                '[^>]*\s*'.
+                '(s|&#0*83;?|&#x0*53;?|&#0*115;?|&#x0*73;?)\s*'.
+                '(c|&#0*67;?|&#x0*43;?|&#0*99;?|&#x0*63;?)\s*'.
+                '(r|&#0*82;?|&#x0*52;?|&#0*114;?|&#x0*72;?)\s*'.
+                '(i|&#0*73;?|&#x0*49;?|&#0*105;?|&#x0*69;?)\s*'.
+                '(p|&#0*80;?|&#x0*50;?|&#0*112;?|&#x0*70;?)\s*'.
+                '(t|&#0*84;?|&#x0*54;?|&#0*116;?|&#x0*74;?)\s*'.
+                '(:|&#0*58;?|&#x0*3a;?)/i';
         $data = preg_replace($preg, '=\2cleaned', $data);
 
         /* Get all on<foo>="bar()" tags. */