diff options
| author | Yasuhiro Kimura <yasu@FreeBSD.org> | 2022-05-03 10:06:33 +0000 |
|---|---|---|
| committer | Yasuhiro Kimura <yasu@FreeBSD.org> | 2022-05-03 10:12:56 +0000 |
| commit | f9f524f160cb67555ffab240926b693d090ebd20 (patch) | |
| tree | 9206f5731cd1319d01d407ad75842461d976c085 | |
| parent | d9b2c35e30247340954f934a12d6be6a8ddae1ba (diff) | |
| download | ports-f9f524f160cb67555ffab240926b693d090ebd20.tar.gz ports-f9f524f160cb67555ffab240926b693d090ebd20.zip | |
mail/rainloop: Add patch to fix cross-site-scripting (XSS) vulnerability
PR: 263749
Reported by: Lapo Luchini
Obtained from: https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw
MFH: 2022Q2
Security: a8118db0-cac2-11ec-9288-0800270512f4
| -rw-r--r-- | mail/rainloop/Makefile | 2 | ||||
| -rw-r--r-- | mail/rainloop/files/patch-rainloop_v_1.16.0_app_libraries_MailSo_Base_HtmlUtils.php | 21 |
2 files changed, 22 insertions, 1 deletions
diff --git a/mail/rainloop/Makefile b/mail/rainloop/Makefile index 37b9010a9499..1f2dfc496013 100644 --- a/mail/rainloop/Makefile +++ b/mail/rainloop/Makefile @@ -1,6 +1,6 @@ PORTNAME= rainloop DISTVERSION= 1.16.0 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= mail www MASTER_SITES= https://github.com/RainLoop/rainloop-webmail/releases/download/v${PORTVERSION}/ PKGNAMESUFFIX?= ${PHP_PKGNAMESUFFIX} diff --git a/mail/rainloop/files/patch-rainloop_v_1.16.0_app_libraries_MailSo_Base_HtmlUtils.php b/mail/rainloop/files/patch-rainloop_v_1.16.0_app_libraries_MailSo_Base_HtmlUtils.php new file mode 100644 index 000000000000..210cee2adc56 --- /dev/null +++ b/mail/rainloop/files/patch-rainloop_v_1.16.0_app_libraries_MailSo_Base_HtmlUtils.php @@ -0,0 +1,21 @@ +--- rainloop/v/1.16.0/app/libraries/MailSo/Base/HtmlUtils.php.orig 2021-05-06 11:04:36 UTC ++++ rainloop/v/1.16.0/app/libraries/MailSo/Base/HtmlUtils.php +@@ -239,7 +239,8 @@ class HtmlUtils
+ $oWrapHtml->setAttribute($sKey, $sValue);
+ }
+
+- $oWrapDom = $oDom->createElement('div', '___xxx___');
++ $rand_str = base64_encode(random_bytes(32));
++ $oWrapDom = $oDom->createElement('div', $rand_str);
+ $oWrapDom->setAttribute('data-x-div-type', 'body');
+ foreach ($aBodylAttrs as $sKey => $sValue)
+ {
+@@ -250,7 +251,7 @@ class HtmlUtils
+
+ $sWrp = $oDom->saveHTML($oWrapHtml);
+
+- $sResult = \str_replace('___xxx___', $sResult, $sWrp);
++ $sResult = \str_replace($rand_str, $sResult, $sWrp);
+ }
+
+ $sResult = \str_replace(\MailSo\Base\HtmlUtils::$KOS, ':', $sResult);
|