diff options
| author | thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2011-12-10 01:50:03 +0000 |
|---|---|---|
| committer | thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2011-12-10 01:50:03 +0000 |
| commit | 00572749829e7c6363684f5692af3930aa955d8e (patch) | |
| tree | 27af3250ecf70458a9cd8e820930b4c6b351a3a0 /roundcubemail/tests/src | |
| parent | 787cc568ceab1a97db843cf001ddb612ce2b3f9e (diff) | |
Be more strict in style attribute filtering
git-svn-id: https://svn.roundcube.net/trunk@5590 208e9e7b-5314-0410-a742-e7e81cd9613c
Diffstat (limited to 'roundcubemail/tests/src')
| -rw-r--r-- | roundcubemail/tests/src/BID-26800.txt | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/roundcubemail/tests/src/BID-26800.txt b/roundcubemail/tests/src/BID-26800.txt index 513516c09..e4e2fe795 100644 --- a/roundcubemail/tests/src/BID-26800.txt +++ b/roundcubemail/tests/src/BID-26800.txt @@ -10,13 +10,14 @@ <h1>2 test</h1> <p><div> block</p> <div style="font-style:italic">valid css</div> +<div style="color:red; background:url('//somedomain.com/somepath/somefile.png')"> <div style="{ left:expression( alert('expression!') ) }"> <div style="{ background:url( alert('URL!') ) }"> <h1>3 test</h1> <p>Inject comment text</p> <div style="{ left:exp/* */ression( alert('xss3') ) }"> -<div style="{ background:u/* */rl( alert('xssurl3') ) }"> +<div style=" background:u/* */rl( alert('xssurl3') ) "> <h1>4 test</h1> <p>Using reverse solid to directe the codepoint</p> |