roundcubemail/program/lib/Roundcube/rcube_washtml.php
private function wash_style($style)
    {
        $result = array();

        // Remove unwanted white-space characters so regular expressions below work better
        $style = preg_replace('/[\n\r\s\t]+/', ' ', $style);

        // Decode insecure character sequences
        $style = rcube_utils::xss_entity_decode($style);

        foreach (explode(';', $style) as $declaration) {
            if (preg_match('/^\s*([a-z\\\-]+)\s*:\s*(.*)\s*$/i', $declaration, $match)) {
                $cssid = $match[1];
                $str   = $match[2];
                $value = '';

                foreach ($this->explode_style($str) as $val) {
                    if (preg_match('/^url\(/i', $val)) {
                        if (preg_match('/^url\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu', $val, $match)) {
                            if ($url = $this->wash_uri($match[1])) {
                                $value .= ' url(' . htmlspecialchars($url, ENT_QUOTES) . ')';
                            }
                        }
                    }
                    else if (!preg_match('/^(behavior|expression)/i', $val)) {
                        // Set position:fixed to position:absolute for security (#5264)
                        if (!strcasecmp($cssid, 'position') && !strcasecmp($val, 'fixed')) {
                            $val = 'absolute';
                        }

                        // whitelist ?
                        $value .= ' ' . $val;

                        // #1488535: Fix size units, so width:800 would be changed to width:800px
                        if (preg_match('/^(left|right|top|bottom|width|height)/i', $cssid)
                            && preg_match('/^[0-9]+$/', $val)
                        ) {
                            $value .= 'px';
                        }
                    }
                }

                if (isset($value[0])) {
                    $result[] = $cssid . ':' . $value;
                }
            }
        }

        return implode('; ', $result);
    }
private function wash_style($style)
    {
        $result = array();

        // Remove unwanted white-space characters so regular expressions below work better
        $style = preg_replace('/[\n\r\s\t]+/', ' ', $style);

        // Decode insecure character sequences
        $style = rcube_utils::xss_entity_decode($style);

        foreach (explode(';', $style) as $declaration) {
            if (preg_match('/^\s*([a-z\\\-]+)\s*:\s*(.*)\s*$/i', $declaration, $match)) {
                $cssid = $match[1];
                $str   = $match[2];
                $value = '';

                foreach ($this->explode_style($str) as $val) {
                    if (preg_match('/^url\(/i', $val)) {
                        if (preg_match('/^url\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu', $val, $match)) {
                            if ($url = $this->wash_uri($match[1])) {
                                $value .= ' url(' . htmlspecialchars($url, ENT_QUOTES) . ')';
                            }
                        }
                    }
                    else if (!preg_match('/^(behavior|expression)/i', $val)) {
                        // Set position:fixed to position:absolute for security (#5264)
                        if (!strcasecmp($cssid, 'position') && !strcasecmp($val, 'fixed')) {
                            $val = 'absolute';
                        }

                        // whitelist ?
                        $value .= ' ' . $val;

                        // #1488535: Fix size units, so width:800 would be changed to width:800px
                        if (preg_match('/^(left|right|top|bottom|width|height)/i', $cssid)
                            && preg_match('/^[0-9]+$/', $val)
                        ) {
                            $value .= 'px';
                        }
                    }
                }

                if (isset($value[0])) {
                    $result[] = $cssid . ':' . $value;
                }
            }
        }

        return implode('; ', $result);
    }
private function wash_style ( $ style ) { $ result = array ( ) ; // Remove unwanted white-space characters so regular expressions below work better $ style = preg_replace ( '/[\n\r\s\t]+/' , ' ' , $ style ) ; // Decode insecure character sequences $ style = rcube_utils :: xss_entity_decode ( $ style ) ; foreach ( explode ( ';' , $ style ) as $ declaration ) { if ( preg_match ( '/^\s*([a-z\\\-]+)\s*:\s*(.*)\s*$/i' , $ declaration , $ match ) ) { $ cssid = $ match [ 1 ] ; $ str = $ match [ 2 ] ; $ value = '' ; foreach ( $ this -> explode_style ( $ str ) as $ val ) { if ( preg_match ( '/^url\(/i' , $ val ) ) { if ( preg_match ( '/^url\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu' , $ val , $ match ) ) { if ( $ url = $ this -> wash_uri ( $ match [ 1 ] ) ) { $ value .= ' url(' . htmlspecialchars ( $ url , ENT_QUOTES ) . ')' ; } } } else if ( ! preg_match ( '/^(behavior|expression)/i' , $ val ) ) { // Set position:fixed to position:absolute for security (#5264) if ( ! strcasecmp ( $ cssid , 'position' ) && ! strcasecmp ( $ val , 'fixed' ) ) { $ val = 'absolute' ; } // whitelist ? $ value .= ' ' . $ val ; // #1488535: Fix size units, so width:800 would be changed to width:800px if ( preg_match ( '/^(left|right|top|bottom|width|height)/i' , $ cssid ) && preg_match ( '/^[0-9]+$/' , $ val ) ) { $ value .= 'px' ; } } } if ( isset ( $ value [ 0 ] ) ) { $ result [ ] = $ cssid . ':' . $ value ; } } } return implode ( '; ' , $ result ) ; }
Check CSS style
Check CSS style