HomePhorge

Fix: Keep children of object tag (#6453)

Description

Fix: Keep children of object tag (#6453)

The HTML tag <object> optionally has embedded (child) tags that serve as an
alternative (fallback) HTML representation for the object. Of course, the
object and its parameters are considered harmful in HTML mail, but the
alternative representation is meant for exactly this kind of situation. They
should display the object contents without loading possibly insecure code.

  • By ignoring <object> tags, roundcube also removes all their child nodes
  • As <object> is not in the list of allowed $html_elements and <param> gets cleaned through $void_elements, they get ignored anyway, without removing the valuable child nodes.

Co-authored-by: root <root@coreboso-kolab.coreboso.de>

Details

Provenance
Achim Leitner <git@fjl.de>Authored on Aug 7 2020, 9:06 AM
GitHub <noreply@github.com>Committed on Aug 7 2020, 9:06 AM
mollekopfPushed on Aug 21 2023, 3:06 PM
Parents
R3:4c8ea71e3a0d: Fix so setting 'login' in config['skin_logo'] does not change the favicon…
Branches
Unknown
Tags
Unknown

Event Timeline