private function wash_style($style)
    {
        $result = array();

        // Remove unwanted white-space characters so regular expressions below work better
        $style = preg_replace('/[\n\r\s\t]+/', ' ', $style);

        // Decode insecure character sequences
        $style = rcube_utils::xss_entity_decode($style);

        foreach (explode(';', $style) as $declaration) {
            if (preg_match('/^\s*([a-z\\\-]+)\s*:\s*(.*)\s*$/i', $declaration, $match)) {
                $cssid = $match[1];
                $str   = $match[2];
                $value = '';

                foreach ($this->explode_style($str) as $val) {
                    if (preg_match('/^url\(/i', $val)) {
                        if (preg_match('/^url\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu', $val, $match)) {
                            if ($url = $this->wash_uri($match[1])) {
                                $value .= ' url(' . htmlspecialchars($url, ENT_QUOTES) . ')';
                            }
                        }
                    }
                    else if (!preg_match('/^(behavior|expression)/i', $val)) {
                        // Set position:fixed to position:absolute for security (#5264)
                        if (!strcasecmp($cssid, 'position') && !strcasecmp($val, 'fixed')) {
                            $val = 'absolute';
                        }

                        // whitelist ?
                        $value .= ' ' . $val;

                        // #1488535: Fix size units, so width:800 would be changed to width:800px
                        if (preg_match('/^(left|right|top|bottom|width|height)/i', $cssid)
                            && preg_match('/^[0-9]+$/', $val)
                        ) {
                            $value .= 'px';
                        }
                    }
                }

                if (isset($value[0])) {
                    $result[] = $cssid . ':' . $value;
                }
            }
        }

        return implode('; ', $result);
    }