[GH-ISSUE #222] [BUG] Text-Form of a HTML-EMail has trouble with links #185

New issue

Closed

opened 2026-02-25 21:34:22 +03:00 by kerem · 4 comments

kerem commented

2026-02-25 21:34:22 +03:00

Owner

Originally created by @ulfgebhardt on GitHub (Aug 25, 2017).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/222

Originally assigned to: @jasonmunro on GitHub.

Hello,
me again - another thing i just noticed

The Link contains the closing ">" which makes it invalid.
This applies only to the Text-Form of a HTML EMail. In HTML Form it works correctly.

The Text-Form seems not to be HTML-Escaped. This could be an security risk, even in Text-Form.
See: htmlentities

Grüße Ulf

Originally created by @ulfgebhardt on GitHub (Aug 25, 2017). Original GitHub issue: https://github.com/cypht-org/cypht/issues/222 Originally assigned to: @jasonmunro on GitHub. Hello, me again - another thing i just noticed ![crypht7](https://user-images.githubusercontent.com/1238238/29735164-221d3724-89f7-11e7-98a6-3de681463a0c.png) The Link contains the closing ">" which makes it invalid. This applies only to the Text-Form of a HTML EMail. In HTML Form it works correctly. ~~The Text-Form seems not to be HTML-Escaped. This could be an security risk, even in Text-Form. See: [htmlentities](http://php.net/manual/en/function.htmlentities.php)~~ Grüße Ulf <3

kerem

2026-02-25 21:34:22 +03:00

closed this issue
added the
bug

core
labels

kerem commented

2026-02-25 21:34:23 +03:00

Author

Owner

@jasonmunro commented on GitHub (Aug 26, 2017):

Text messages are escaped, it's actually the reason this bug exists :) URLs that have a trailing > accidentally match our url regex because they have already been changed to an entity. We can't do the regex before we escape the content, because the links we insert would be escaped as well. To solve this I made a change that does the following:

escape the content as before
insert a space before any html entity
replace strings that look like URLs (match our regex) with actual links
remove a single space before any html entity

So far it looks like it's working for me. Let me know how it works for you when you can, and again thanks for the feedback!

@jasonmunro commented on GitHub (Aug 26, 2017): Text messages are escaped, it's actually the reason this bug exists :) URLs that have a trailing > accidentally match our url regex because they have already been changed to an entity. We can't do the regex before we escape the content, because the links we insert would be escaped as well. To solve this I made a change that does the following: - escape the content as before - insert a space before any html entity - replace strings that look like URLs (match our regex) with actual links - remove a single space before any html entity So far it looks like it's working for me. Let me know how it works for you when you can, and again thanks for the feedback!

kerem commented

2026-02-25 21:34:23 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 7, 2017):

Found and fixed a bug with this, but I believe it is now working better

@jasonmunro commented on GitHub (Sep 7, 2017): Found and fixed a bug with this, but I believe it is now working better

kerem commented

2026-02-25 21:34:23 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 12, 2017):

@ulfgebhardt I would like to close this since I think it's fixed, if you could confirm for me that would be great! Thanks!

@jasonmunro commented on GitHub (Sep 12, 2017): @ulfgebhardt I would like to close this since I think it's fixed, if you could confirm for me that would be great! Thanks!

kerem commented

2026-02-25 21:34:23 +03:00

Author

Owner

@ulfgebhardt commented on GitHub (Sep 13, 2017):

Is fixed, please close!

Rev: 26a3870e58

Grüße Ulf

@ulfgebhardt commented on GitHub (Sep 13, 2017): Is fixed, please close! Rev: 26a3870e58702787c0b8356863b8c4108a9bf1d7 Grüße Ulf <3