kde/patch/messagelib/messagelib_CVE-2018-19516.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

From 34765909cdf8e55402a8567b48fb288839c61612 Mon Sep 17 00:00:00 2001
From: Laurent Montel <montel@kde.org>
Date: Fri, 23 Nov 2018 07:37:02 +0100
Subject: Exclude Refresh from MetaData (Not necessary)

diff -uar messagelib-18.08.3.orig/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp messagelib-18.08.3/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
--- messagelib-18.08.3.orig/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp	2018-10-31 07:56:07.000000000 +0100
+++ messagelib-18.08.3/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp	2018-12-09 23:38:11.009130622 +0100
@@ -308,6 +308,11 @@
             return htmlSource;
         }
         extraHead = s.mid(startIndex + 6 , endIndex - startIndex - 6);
+        //Don't authorize to refresh content.
+        if (s.contains(QStringLiteral("http-equiv=\"REFRESH\""), Qt::CaseInsensitive)) {
+            extraHead.clear();
+        }
+
         s = s.mid(endIndex + 7).trimmed();
     }