Version in base suite: 1.6.13+dfsg-0+deb13u1 Base version: roundcube_1.6.13+dfsg-0+deb13u1 Target version: roundcube_1.6.15+dfsg-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/r/roundcube/roundcube_1.6.13+dfsg-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/r/roundcube/roundcube_1.6.15+dfsg-0+deb13u1.dsc CHANGELOG.md | 18 + composer.json-dist | 3 debian/changelog | 25 + debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch | 121 ++++++++ debian/patches/Fix-FTBFS-with-phpunit-11.patch | 142 ++++------ debian/patches/fix-install-path.patch | 4 debian/patches/map-sqlite3-to-sqlite.patch | 2 debian/patches/series | 1 debian/patches/update-composer.patch | 14 plugins/password/password.php | 4 program/actions/mail/index.php | 2 program/actions/mail/search.php | 4 program/actions/mail/send.php | 3 program/actions/utils/modcss.php | 2 program/include/iniset.php | 11 program/include/rcmail_action.php | 3 program/lib/Roundcube/db/mysql.php | 5 program/lib/Roundcube/rcube_db.php | 6 program/lib/Roundcube/rcube_utils.php | 48 +++ program/lib/Roundcube/rcube_washtml.php | 46 ++- program/localization/lv_LV/messages.inc | 8 public_html/plugins/password/password.php | 4 tests/Framework/DB.php | 4 tests/Framework/DBMysql.php | 16 - tests/Framework/DBPgsql.php | 8 tests/Framework/Utils.php | 37 ++ tests/Framework/Washtml.php | 41 ++ 27 files changed, 453 insertions(+), 129 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsxg_4fjm/roundcube_1.6.13+dfsg-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsxg_4fjm/roundcube_1.6.15+dfsg-0+deb13u1.dsc: no acceptable signature found diff -Nru roundcube-1.6.13+dfsg/CHANGELOG.md roundcube-1.6.15+dfsg/CHANGELOG.md --- roundcube-1.6.13+dfsg/CHANGELOG.md 2026-02-08 09:25:02.000000000 +0000 +++ roundcube-1.6.15+dfsg/CHANGELOG.md 2026-03-29 09:45:29.000000000 +0000 @@ -2,6 +2,24 @@ ## Unreleased +- Fix regression where mail search would fail on non-ascii search criteria (#10121) +- Fix regression where some data url images could get ignored/lost (#10128) +- Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke + +## Release 1.6.14 + +- Fix Postgres connection using IPv6 address (#10104) +- Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler +- Security: Fix bug where a password could get changed without providing the old password +- Security: Fix IMAP Injection + CSRF bypass in mail search +- Security: Fix remote image blocking bypass via various SVG animate attributes +- Security: Fix remote image blocking bypass via a crafted body background attribute +- Security: Fix fixed position mitigation bypass via use of !important +- Security: Fix XSS issue in a HTML attachment preview +- Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts + +## Release 1.6.13 + - Managesieve: Fix handling of string-list format values for date tests in Out of Office (#10075) - Fix remote image blocking bypass via SVG content reported by nullcathedral - Fix CSS injection vulnerability reported by CERT Polska diff -Nru roundcube-1.6.13+dfsg/composer.json-dist roundcube-1.6.15+dfsg/composer.json-dist --- roundcube-1.6.13+dfsg/composer.json-dist 2026-02-08 09:25:02.000000000 +0000 +++ roundcube-1.6.15+dfsg/composer.json-dist 2026-03-29 09:45:29.000000000 +0000 @@ -20,7 +20,8 @@ "roundcube/rtf-html-php": "~2.1", "masterminds/html5": "~2.7.0", "bacon/bacon-qr-code": "^2.0.0", - "guzzlehttp/guzzle": "^7.3.0" + "guzzlehttp/guzzle": "^7.3.0", + "mlocati/ip-lib": "^1.22.0" }, "require-dev": { "phpunit/phpunit": "^9" diff -Nru roundcube-1.6.13+dfsg/debian/changelog roundcube-1.6.15+dfsg/debian/changelog --- roundcube-1.6.13+dfsg/debian/changelog 2026-02-11 09:55:46.000000000 +0000 +++ roundcube-1.6.15+dfsg/debian/changelog 2026-03-30 11:40:22.000000000 +0000 @@ -1,3 +1,28 @@ +roundcube (1.6.15+dfsg-0+deb13u1) trixie-security; urgency=high + + * New upstream security and bugfix release (closes: #1131182, #1132268). + + Fix CVE-2026-35537: Pre-auth arbitrary file write via unsafe + deserialization in redis/memcache session handler. + + Fix CVE-2026-35538: IMAP Injection + CSRF bypass in mail search. + + Fix CVE-2026-35539: XSS vulnerability in HTML attachment preview. + + Fix CVE-2026-35540: SSRF and information disclosure vulnerability via + stylesheet links pointing to a local network hosts. + + Fix CVE-2026-35541: A password could get changed without providing the + old password in some situations. + + Fix CVE-2026-35542: Remote image blocking bypass via a crafted + background attribute. + + Fix CVE-2026-35543: Remote image blocking bypass via various SVG animate + attributes. + + Fix CVE-2026-35544: Fixed position mitigation bypass via use of + `!important`. + + Fix CVE-2026-35545: SVG animate FUNCIRI attribute bypass (remote image + loading via fill/filter/stroke). + * Refresh d/patches. + * Add custom patch to avoid runtime dependency on mlocati/ip-lib which is + not present in trixie. + + -- Guilhem Moulin Mon, 30 Mar 2026 13:40:22 +0200 + roundcube (1.6.13+dfsg-0+deb13u1) trixie-security; urgency=high * New upstream security and bugfix release (closes: #1127447). diff -Nru roundcube-1.6.13+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch roundcube-1.6.15+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch --- roundcube-1.6.13+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch 1970-01-01 00:00:00.000000000 +0000 +++ roundcube-1.6.15+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch 2026-03-30 11:40:22.000000000 +0000 @@ -0,0 +1,121 @@ +From: Guilhem Moulin +Date: Fri, 20 Mar 2026 17:34:30 +0100 +Subject: Avoid dependency on new package mlocati/ip-lib + +Which as of today is not present in Debian. The dependency was +introduced in 27ec6cc9cb25e1ef8b4d4ef39ce76d619caa6870 in order to fix a +security issue. While it can be uploaded to sid, we need another +solution to fix the vulnerability for older suites. + +Forwarded: not-needed +--- + composer.json-dist | 3 +-- + program/lib/Roundcube/rcube_utils.php | 45 ++++++++++++++++++++++++----------- + tests/Framework/Utils.php | 6 +++++ + 3 files changed, 38 insertions(+), 16 deletions(-) + +diff --git a/composer.json-dist b/composer.json-dist +index 1807004..ca3de26 100644 +--- a/composer.json-dist ++++ b/composer.json-dist +@@ -16,8 +16,7 @@ + "pear-pear.php.net/net_sieve": ">=1.4.5", + "roundcube/plugin-installer": ">=0.3.1", + "masterminds/html5": ">=2.7.0", +- "guzzlehttp/guzzle": ">=7.3.0", +- "mlocati/ip-lib": ">=1.22.0" ++ "guzzlehttp/guzzle": ">=7.3.0" + }, + "require-dev": { + "phpunit/phpunit": "^9" +diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php +index 5e8ac84..d20a509 100644 +--- a/program/lib/Roundcube/rcube_utils.php ++++ b/program/lib/Roundcube/rcube_utils.php +@@ -1,7 +1,5 @@ + contains($address)) { ++ foreach ($nets as [$range_start, $range_end]) { ++ $range_start = @inet_pton($range_start); ++ $range_end = @inet_pton($range_end); ++ if (strcmp($range_start, $address) <= 0 && strcmp($range_end, $address) >= 0) { + return true; + } + } +- + return false; + } + +diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php +index a27829c..399cea7 100644 +--- a/tests/Framework/Utils.php ++++ b/tests/Framework/Utils.php +@@ -585,12 +585,18 @@ class Framework_Utils extends TestCase + return [ + // Local hosts + ['https://127.0.0.1', true], ++ ['https://127.00.000.0', true], + ['https://10.1.1.1', true], + ['https://172.16.0.1', true], + ['https://192.168.0.100', true], + ['https://169.254.0.200', true], + ['http://[fc00::1]', true], + ['ftp://[::1]:8080', true], ++ ['https://[127.0.0.1]', true], ++ ['https://[::127.0.0.1]', true], ++ ['https://[::127.0.0.001]', true], ++ ['https://[::ffff:192.168.1.2]', true], ++ ['https://[::ffff:192.168.01.002]', true], + ['//127.0.0.1', true], + ['http://localhost', true], + ['http://localhost.localdomain', true], diff -Nru roundcube-1.6.13+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch roundcube-1.6.15+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch --- roundcube-1.6.13+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch 2026-02-11 09:55:46.000000000 +0000 +++ roundcube-1.6.15+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch 2026-03-30 11:40:22.000000000 +0000 @@ -161,7 +161,7 @@ tests/Framework/Csv2vcard.php | 18 +- tests/Framework/DB.php | 27 +-- tests/Framework/DBMssql.php | 14 +- - tests/Framework/DBMysql.php | 14 +- + tests/Framework/DBMysql.php | 11 +- tests/Framework/DBOracle.php | 14 +- tests/Framework/DBPgsql.php | 22 ++- tests/Framework/DBSqlite.php | 14 +- @@ -222,7 +222,7 @@ tests/StderrMock.php | 15 +- tests/StorageMock.php | 4 +- tests/bootstrap.php | 21 ++- - 213 files changed, 2502 insertions(+), 1796 deletions(-) + 213 files changed, 2501 insertions(+), 1794 deletions(-) diff --git a/plugins/acl/tests/Acl.php b/plugins/acl/tests/Acl.php index 94e0bd4..0ad987f 100644 @@ -7405,7 +7405,7 @@ $result = $csv->export(); diff --git a/tests/Framework/DB.php b/tests/Framework/DB.php -index 3ac4f13..853489d 100644 +index 3700564..b697cf4 100644 --- a/tests/Framework/DB.php +++ b/tests/Framework/DB.php @@ -1,12 +1,17 @@ @@ -7528,16 +7528,17 @@ } } diff --git a/tests/Framework/DBMysql.php b/tests/Framework/DBMysql.php -index 1d5a3fc..79fe7d1 100644 +index ce7e68d..75dcc8f 100644 --- a/tests/Framework/DBMysql.php +++ b/tests/Framework/DBMysql.php -@@ -1,13 +1,19 @@ +@@ -1,13 +1,20 @@ assertInstanceOf('rcube_db_mysql', $object, "Class constructor"); -+ $this->assertInstanceOf(\rcube_db_mysql::class, $object, "Class constructor"); - } - } diff --git a/tests/Framework/DBOracle.php b/tests/Framework/DBOracle.php index 8fff546..cb2cab9 100644 --- a/tests/Framework/DBOracle.php @@ -7602,7 +7592,7 @@ } } diff --git a/tests/Framework/DBPgsql.php b/tests/Framework/DBPgsql.php -index 86f30a8..edc7bef 100644 +index f081c25..dd505a3 100644 --- a/tests/Framework/DBPgsql.php +++ b/tests/Framework/DBPgsql.php @@ -1,22 +1,30 @@ @@ -10006,7 +9996,7 @@ $idents = $user->list_identities(); diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php -index e65b5a9..8809da2 100644 +index 3baa861..a27829c 100644 --- a/tests/Framework/Utils.php +++ b/tests/Framework/Utils.php @@ -1,11 +1,15 @@ @@ -10203,8 +10193,8 @@ $this->assertEquals("#rcmbody .test { position: absolute; top: 0; }", $mod, "Replace position:fixed with position:absolute (5)"); // missing closing brace -@@ -281,27 +290,27 @@ class Framework_Utils extends PHPUnit\Framework\TestCase - $this->assertSame('#rcmbody .test { position: absolute; top: 0; }', $mod, 'Replace position:fixed with position:absolute (6)'); +@@ -284,27 +293,27 @@ class Framework_Utils extends PHPUnit\Framework\TestCase + $this->assertSame('#rcmbody .test { position: absolute; }', $mod, 'Replace position:fixed with position:absolute (7)'); // allow data URIs with images (#5580) - $mod = rcube_utils::mod_css_styles("body { background-image: url(data:image/png;base64,123); }", 'rcmbody'); @@ -10237,7 +10227,7 @@ $this->assertSame("#rcmbody { color: red; }", $mod); $style = 'body { background:url(alert('URL!')); }'; -@@ -335,7 +344,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -338,7 +347,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase :root * { color: red; } :root > * { top: 0; } '; @@ -10246,7 +10236,7 @@ $this->assertStringContainsString('#rc .testone', $mod); $this->assertStringContainsString('#rc .testthree.testfour', $mod); -@@ -353,24 +362,24 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -356,24 +365,24 @@ class Framework_Utils extends PHPUnit\Framework\TestCase function test_xss_entity_decode() { @@ -10276,7 +10266,7 @@ { return [ [ -@@ -445,9 +454,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -448,9 +457,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_parse_css_block */ @@ -10288,7 +10278,7 @@ } /** -@@ -462,7 +472,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -465,7 +475,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($data as $text => $res) { @@ -10297,7 +10287,7 @@ $this->assertSame($res, $result); } } -@@ -475,7 +485,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -478,7 +488,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase $data = ['', 'a,b,c', 'a', ',', ',a']; foreach ($data as $text) { @@ -10306,7 +10296,7 @@ $this->assertSame(explode(',', $text), $result); } } -@@ -490,7 +500,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -493,7 +503,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($input as $idx => $value) { @@ -10315,7 +10305,7 @@ } $input = [ -@@ -498,7 +508,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -501,7 +511,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($input as $idx => $value) { @@ -10324,7 +10314,7 @@ } } -@@ -508,13 +518,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -511,13 +521,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase function test_get_input_string() { $_GET = []; @@ -10341,7 +10331,7 @@ } /** -@@ -522,18 +532,18 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -525,18 +535,18 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_is_simple_string() { @@ -10372,7 +10362,7 @@ } /** -@@ -548,7 +558,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -551,7 +561,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $v) { @@ -10381,7 +10371,7 @@ $this->assertSame($v[2], $result); } } -@@ -578,7 +588,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -615,7 +625,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10390,7 +10380,7 @@ $this->assertSame($ts, $result, "Error parsing date: $datetime"); } } -@@ -605,7 +615,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -642,7 +652,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10399,7 +10389,7 @@ $this->assertSame($ts, $result ? $result->format('Y-m-d') : false, "Error parsing date: $datetime"); } -@@ -615,7 +625,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -652,7 +662,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10408,7 +10398,7 @@ $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime"); } -@@ -624,7 +634,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -661,7 +671,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $datetime => $ts) { @@ -10417,7 +10407,7 @@ $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime"); } } -@@ -634,17 +644,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -671,17 +681,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_anytodatetime_timezone() { @@ -10438,7 +10428,7 @@ if ($result) $result->setTimezone($tz); // move to target timezone for comparison $this->assertSame($ts, $result ? $result->format('Y-m-d H:i') : false, "Error parsing date: $datetime"); } -@@ -663,7 +673,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -700,7 +710,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $data) { @@ -10447,7 +10437,7 @@ $this->assertSame($data[2], $result, "Error formatting date: " . $data[0]); } } -@@ -682,7 +692,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -719,7 +729,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $input => $output) { @@ -10456,7 +10446,7 @@ $this->assertSame($output, $result); } } -@@ -707,7 +717,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -744,7 +754,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $input => $output) { @@ -10465,7 +10455,7 @@ $this->assertSame($output, $result, "Error normalizing '$input'"); } } -@@ -730,7 +740,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -767,7 +777,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase ]; foreach ($test as $idx => $params) { @@ -10474,7 +10464,7 @@ $this->assertSame($params[2], $result, "words_match() at index $idx"); } } -@@ -756,7 +766,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -793,7 +803,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase } foreach ($test as $input => $output) { @@ -10483,7 +10473,7 @@ $this->assertSame($output, $result); } } -@@ -766,17 +776,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -803,17 +813,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_random_bytes() { @@ -10507,7 +10497,7 @@ { /* -@@ -813,9 +823,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -850,9 +860,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * @param string $encoded Encoded email address * @dataProvider data_idn_convert */ @@ -10519,7 +10509,7 @@ } /** -@@ -825,9 +836,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -862,9 +873,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * @param string $encoded Encoded email address * @dataProvider data_idn_convert */ @@ -10531,7 +10521,7 @@ } /** -@@ -835,14 +847,14 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -872,14 +884,14 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_idn_to_ascii_special() { @@ -10549,7 +10539,7 @@ { return [ ['%z', 'hostname', 'hostname'], -@@ -857,15 +869,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -894,15 +906,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_parse_host */ @@ -10568,7 +10558,7 @@ { return [ [['hostname', null, null], ['hostname', null, null]], -@@ -888,15 +901,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -925,15 +938,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_parse_host_uri */ @@ -10587,7 +10577,7 @@ return [ ['both', 'Fwd: Re: Test subject both', 'Test subject both'], ['both', 'Re: Fwd: Test subject both', 'Test subject both'], -@@ -914,8 +928,9 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -951,8 +965,9 @@ class Framework_Utils extends PHPUnit\Framework\TestCase * * @dataProvider data_remove_subject_prefix */ @@ -10598,7 +10588,7 @@ } /** -@@ -923,13 +938,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -960,13 +975,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase */ function test_server_name() { @@ -10615,7 +10605,7 @@ } /** -@@ -939,31 +954,31 @@ class Framework_Utils extends PHPUnit\Framework\TestCase +@@ -976,31 +991,31 @@ class Framework_Utils extends PHPUnit\Framework\TestCase { $_SERVER['test'] = 'test.com'; @@ -10814,7 +10804,7 @@ $this->assertSame($result, "BEGIN:VCARD\r\nVERSION:3.0\r\nFN:\r\nN:;;;;\r\nEND:VCARD"); diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php -index ef324f8..e8e5a4a 100644 +index ec1dd5d..99859a3 100644 --- a/tests/Framework/Washtml.php +++ b/tests/Framework/Washtml.php @@ -1,11 +1,14 @@ @@ -10855,13 +10845,13 @@ $this->assertMatchesRegularExpression('|href="http://test\.com"|', $washed, "Link href with newlines (#1488940)"); @@ -56,7 +59,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase { - $html = "

"; + $html = "

"; - $washer = new rcube_washtml; + $washer = new \rcube_washtml(); $washed = $washer->wash($html); - $this->assertSame("

", $this->cleanupResult($washed)); + $this->assertSame("

", $this->cleanupResult($washed)); @@ -74,7 +77,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase . 'Internet Explorer

' . ''; @@ -10951,8 +10941,8 @@ + $washer = new \rcube_washtml(['html_elements' => ['body']]); $washed = $washer->wash($html); - $this->assertMatchesRegularExpression('|bgcolor="#fff"|', $washed, "Body bgcolor attribute"); -@@ -277,7 +280,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase + $this->assertMatchesRegularExpression('|bgcolor="#fff"|', $washed, 'Body bgcolor attribute'); +@@ -284,7 +287,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase { $html = "

a

"; @@ -10961,7 +10951,7 @@ $washed = $washer->wash($html); $this->assertMatchesRegularExpression('|line-height: 1;|', $washed, "Untouched line-height (#1489917)"); -@@ -286,7 +289,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -293,7 +296,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = "
"; $expected = "
"; @@ -10970,7 +10960,7 @@ $washed = $washer->wash($html); $this->assertSame($this->cleanupResult($washed), $expected, 'White-space and new-line characters handling'); -@@ -300,7 +303,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -307,7 +310,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = ""; $exp = ""; @@ -10979,7 +10969,7 @@ $washed = $washer->wash($html); $this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)"); -@@ -308,7 +311,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -315,7 +318,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = ""; $exp = ""; @@ -10988,7 +10978,7 @@ $washed = $washer->wash($html); $this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)"); -@@ -326,7 +329,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -333,7 +336,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase */ function test_title() { @@ -10997,7 +10987,7 @@ $html = "title1

test

"; $washed = $washer->wash($html); -@@ -372,7 +375,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -379,7 +382,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase '; @@ -11006,7 +10996,7 @@ $washed = $washer->wash($svg); $this->assertSame($washed, $exp, "SVG content"); -@@ -381,7 +384,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -388,7 +391,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase /** * Test cases for SVG tests */ @@ -11015,7 +11005,7 @@ { $svg1 = ""; -@@ -508,9 +511,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -533,9 +536,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase * * @dataProvider data_wash_svg_tests */ @@ -11027,7 +11017,7 @@ $washed = $washer->wash($input); $this->assertSame($expected, $this->cleanupResult($washed), "SVG content"); -@@ -519,7 +523,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -544,7 +548,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase /** * Test cases for various XSS issues */ @@ -11036,7 +11026,7 @@ { return [ [ -@@ -574,9 +578,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -599,9 +603,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase * * @dataProvider data_wash_xss_tests */ @@ -11048,7 +11038,7 @@ $washed = $washer->wash($input); $this->assertSame($expected, $this->cleanupResult($washed), "XSS issues"); -@@ -590,7 +595,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -615,7 +620,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = ""; $exp = ""; @@ -11057,7 +11047,7 @@ $washed = $washer->wash($html); $this->assertTrue(strpos($washed, $exp) !== false, "Position:fixed (#5264)"); -@@ -634,7 +639,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -659,7 +664,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase I_D = \frac{1}{2} k_n \frac{W}{L} (V_{GS}-V_t)^2 '; @@ -11066,7 +11056,7 @@ $washed = $washer->wash($mathml); // remove whitespace between tags -@@ -651,7 +656,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -676,7 +681,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase { $html = ""; @@ -11075,7 +11065,7 @@ $washed = $washer->wash($html); $this->assertTrue($washer->extlinks); -@@ -659,7 +664,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase +@@ -684,7 +689,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase $html = "