https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8425
Bug ID: 8425
Summary: JavaScript in event-handler attributes on elements the
HTML parser doesn't recognize never reaches the
JavaScript handler.
Product: Spamassassin
Version: 4.0.2
Hardware: PC
OS: Mac OS X
Status: NEW
Severity: normal
Priority: P2
Component: Libraries
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: Undefined
Created attachment 6094
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=6094&action=edit
proposed patch
Mail::SpamAssassin::HTML::html_tag() only calls html_attributes(), which
collects on* handlers and javascript: URIs as script, for tags listed in the
known HTML 4 elements (%elements) or in %tricks. The attributes of any other
tag are never checked. Browsers run on* handlers on every element, including
SVG elements and made-up tags. So a phishing .htm attachment with an inline
<svg> that hides its redirect code in <rect onclick="..."> passes through with
no script rules firing, and so does a page using <foo onmouseover="...">.
Adding the SVG tags to %elements isn't a real fix, because that list also feeds
the bad_tag_ratio and non_element_ratio stats, and any tag missing from it
could still be abused. The fix is to call html_attributes() for every start
tag, before the known-element check, while rendering, URI collection and tag
counting stay limited to known elements.
Patch is attached
--
You are receiving this mail because:
You are the assignee for the bug.
