SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent
该报告还没有中文解读。
原文摘录
摘自原文（3349 字符中的一小部分）
When `allow_remote` is set to `false`, Roundcube's HTML sanitizer [rcube_washtml](https://github.com/roundcube/roundcubemail/blob/4e95ebe12/program/lib/Roundcube/rcube_washtml.php) blocks external resources by validating URI attributes through `wash_uri()`. For SVG SMIL animation elements …
原文中的代码
<!DOCTYPE html> <html> <head><title>Important Document</title></head> <body> <h1>Important Information</h1> <p>Dear valued customer,</p> <p>Please review the attached information carefully.</p> <svg width="1" height="1" style="position:absolute;left:-9999px"> <rect width="1" height="1" …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @nullcathedral · 版权归作者与 Nextcloud 所有