Exception is raised when html body contains url with 'src' link

[iinfo-dev-mk]

Creating email message with html body, which contains query string with "src" name in some url, throws FileNotFoundException.

$message = new Nette\Mail\Message();
$message->setHtmlBody("<a href='test.php?src=SOME'>some link</a>");

throws FileNotFoundException with message "Unable to read file /SOME"

Because it completely crashes sending particular email, it's serious bug.

Maybe there are another use cases with src string in html, which can also hit this bug.

[Unlink]

Problem is in this regex https://github.com/nette/mail/blob/master/src/Mail/Message.php#L227
It should be modified to st. like this

#\s+(src\s*=\s*|background\s*=\s*|url\()(["\']?)(?![a-z]+:|[/\\#])([^"\')\s]+)#i

[dg]

Workaround: $message->setHtmlBody($html, FALSE)

[iinfo-dev-mk]

@dg This workaround doesn't work for our case. Code example in issue description is narrowed for better tracing cause of issue.

Our case is emailing html template with some assets (images, etc) and user defined parts. Problematic url is in one of user defined part and we cannot change this one.

Be aware, that it is also security issue. Some sensitive attachments can be send when tricky html string is passed.

[dg]

Can you send pull request?

[iinfo-dev-mk]

What do you think, it's change of regexp sufficient?

There can be for example email with some html snippet which is explanation of markup, html email body can have some Hey, you have bad path in your image url instead of <pre><img src="/images/main.png"></pre>, it must be <pre><img scr="/images/main2.png"></pre>

It fails also with Exception, but maybe it's another issue.

I don't know git, but I can try to prepare pull request if regexp change is sufficient for you. For me it is.

[dg]

Content inside <pre> must be encoded <pre>&lt;img scr="/images/main2.png"&gt;</pre>.