From c6aceeef565b8f653c6f65cabe80a20d079e5fba Mon Sep 17 00:00:00 2001
From: Jakob Sack <mail@jakobsack.de>
Date: Sat, 29 Aug 2015 06:22:37 +0200
Subject: [PATCH] Block external images
---
img/blocked-image.png | Bin 0 -> 180 bytes
lib/service/html.php | 4 +++
lib/service/htmlpurify/transformimagesrc.php | 29 +++++++++++++++++++
3 files changed, 33 insertions(+)
create mode 100644 img/blocked-image.png
create mode 100644 lib/service/htmlpurify/transformimagesrc.php
diff --git a/img/blocked-image.png b/img/blocked-image.png
new file mode 100644
index 0000000000000000000000000000000000000000..425ef4fafed4c96fd4fbbffe3e4781a7a399057e
GIT binary patch
literal 180
zcmeAS@N?(olHy`uVBq!ia0vp^av;pX1SGcvS$+jloCO|{#S9GG!XV7ZFl&wkP>{XE
z)7O>#K8Fmyp!P>AtBXJ(+02lL66gHf+|;}hAeVu`xhOTUBsE2$JhLQ2!QIn0AVn{g
z9Vo8l>EamTaXi^XpysH9^noJ|#s*nmR$N@{)-Pp?#Q0z?#jxi(WBR=ti+6yG^K|ud
JS?83{1OQ))Ggklr
literal 0
HcmV?d00001
diff --git a/lib/service/html.php b/lib/service/html.php
index eb7d1239c..5918370a1 100644
--- a/lib/service/html.php
+++ b/lib/service/html.php
@@ -19,6 +19,7 @@ use HTMLPurifier_HTMLDefinition;
use HTMLPurifier_URISchemeRegistry;
use Kwi\UrlLinker;
use OCA\Mail\Service\HtmlPurify\CidURIScheme;
+use OCA\Mail\Service\HtmlPurify\TransformImageSrc;
use OCA\Mail\Service\HtmlPurify\TransformNoReferrer;
use OCA\Mail\Service\HtmlPurify\TransformURLScheme;
use OCP\IURLGenerator;
@@ -95,6 +96,9 @@ class Html {
$config->set('Cache.DefinitionImpl', null);
// Rewrite URL for redirection and proxying of content
+ $html = $config->getDefinition('HTML');
+ $html->info_attr_transform_post['imagesrc'] = new TransformImageSrc();
+
$uri = $config->getDefinition('URI');
$uri->addFilter(new TransformURLScheme($messageParameters, $mapCidToAttachmentId, $this->urlGenerator), $config);
diff --git a/lib/service/htmlpurify/transformimagesrc.php b/lib/service/htmlpurify/transformimagesrc.php
new file mode 100644
index 000000000..0f1c415c0
--- /dev/null
+++ b/lib/service/htmlpurify/transformimagesrc.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace OCA\Mail\Service\HtmlPurify;
+use HTMLPurifier_AttrTransform;
+use HTMLPurifier_Config;
+use HTMLPurifier_Context;
+use OCP\Util;
+
+/**
+ * Adds copies src to data-src on all img tags.
+ */
+class TransformImageSrc extends HTMLPurifier_AttrTransform {
+ /**
+ * @param array $attr
+ * @param HTMLPurifier_Config $config
+ * @param HTMLPurifier_Context $context
+ * @return array
+ */
+ public function transform($attr, $config, $context) {
+ if ( $context->get('CurrentToken')->name !== 'img' ||
+ !isset($attr['src'])) {
+ return $attr;
+ }
+
+ $attr['data-original-src'] = $attr['src'];
+ $attr['src'] = Util::imagePath('mail', 'blocked-image.png');
+ return $attr;
+ }
+}
--
GitLab