https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8534
Bug ID: 8534
Summary: Script in an HTML body reaches script rules unless its
type is exactly text/javascript
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Plugins
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: Undefined
Created attachment 6237
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=6237&action=edit
make Handler::HTML's body-script test on the canonical type
Handler::HTML passes script to the script handler only when it is in an
attachment that could be run by a user who receives the email, and holds back
script in a rendered HTML body, which no mail client runs. The test for script
to hold back does not catch all script types that the script handler can
handle, only script with no type or with type="text/javascript", and script in
on* attributes. Body script declared with another type, such as
type="application/javascript" or type="text/vbscript", is passed on and matched
by script rules. The test predates bug 8532, but text/vbscript, added there
with VBScript support, is one of the types it misses.
The attached patch adds a canonical_type() function to Message::Node, and makes
the test in Handler::HTML on the canonical type. This holds back the missing
types, and aliases added to the type map later are covered too.
--
You are receiving this mail because:
You are the assignee for the bug.
