Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

Author: alecpl

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - Fix regression where mail search would fail on non-ascii search criteria (#10121)
 - Fix regression where some data url images could get ignored/lost (#10128)
+- Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
 
 ## Release 1.6.14
 

program/lib/Roundcube/rcube_washtml.php

@@ -550,7 +550,8 @@ private static function is_insecure_tag($node)
             return true;
         }
 
-        return self::attribute_value($node, 'attributeName', '/^(mask|cursor)$/i')
+        $rx = '/^(mask|cursor|fill|filter|stroke|clip-path|marker-start|marker-end|marker-mid)$/i';
+        return self::attribute_value($node, 'attributeName', $rx)
             && self::attribute_value($node, 'values', '/url\(/i');
     }
 

tests/Framework/Washtml.php

@@ -521,6 +521,10 @@ function data_wash_svg_tests()
                     . ' feel="freeze" dur="1s" /></svg>',
                 '<svg><!-- animate blocked --></svg>',
             ],
+            [
+                '<svg><animate attributeName="fill" values="url(http://external.site)" dur="1s" begin="0s" fill="freeze" /></svg>',
+                '<svg><!-- animate blocked --></svg>',
+            ],
         ];
     }