From 7ee8ad37f5d39b847fd1d1716457b2b08d04f522 Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub.vrana@csfd.cz>
Date: Sat, 3 Oct 2026 10:31:18 +0200
Subject: [PATCH] HtmlComposer: embeds only images inside the base path

A reference in HTML that comes from untrusted content, e.g. [[../config.neon]]
in a user's message, embedded any readable file into the email. A reference to
a file that is missing, is not an image or is outside the base path now throws
Nette\InvalidArgumentException (a missing file threw Nette\IOException before).
[[...]] may be just a text, so it is left untouched in such a case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/Mail/HtmlComposer.php    | 40 +++++++++++++++++++++++++++++++-----
 tests/Mail/HtmlComposer.phpt | 35 +++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 5 deletions(-)

diff --git a/src/Mail/HtmlComposer.php b/src/Mail/HtmlComposer.php
index 3554d7c..0129eb9 100644
--- a/src/Mail/HtmlComposer.php
+++ b/src/Mail/HtmlComposer.php
@@ -8,8 +8,10 @@
 namespace Nette\Mail;
 
 use Nette;
+use Nette\Utils\FileSystem;
 use Nette\Utils\Strings;
-use function array_map, array_reverse, explode, implode, is_string, rtrim, strlen, substr, substr_replace, trim, urldecode;
+use function array_key_exists, array_map, array_reverse, explode, finfo_file, finfo_open, implode, is_file, is_string, rtrim, str_starts_with, strlen, substr, substr_replace, trim, urldecode;
+use const DIRECTORY_SEPARATOR, FILEINFO_MIME_TYPE;
 
 
 /**
@@ -31,7 +33,9 @@ public function __construct(
 	/**
 	 * Enables embedding of local images referenced in HTML. The path is the base directory
 	 * for resolving relative image references in <img src>, <body background>, url(...) in
-	 * style attributes/<style> tags, and the [[file]] placeholder.
+	 * style attributes/<style> tags, and the [[file]] placeholder. A reference to a file that is
+	 * missing, is not an image or is outside of the base directory throws an exception, except
+	 * the [[file]] placeholder, which is left untouched.
 	 */
 	public function embedImages(string $basePath): static
 	{
@@ -124,9 +128,18 @@ private static function embedImagesInHtml(string $html, string $basePath, Messag
 		);
 		foreach (array_reverse($matches) as $m) {
 			$file = rtrim($basePath, '/\\') . '/' . (isset($m[4]) ? $m[4][0] : urldecode($m[3][0]));
-			if (!isset($cids[$file])) {
-				$contentId = $mail->addEmbeddedFile($file)->getHeader('Content-ID');
-				$cids[$file] = is_string($contentId) ? substr($contentId, 1, -1) : '';
+			if (!array_key_exists($file, $cids)) {
+				$cids[$file] = null;
+				if (self::isEmbeddableImage($file, $basePath)) {
+					$contentId = $mail->addEmbeddedFile($file)->getHeader('Content-ID');
+					$cids[$file] = is_string($contentId) ? substr($contentId, 1, -1) : '';
+				} elseif (!isset($m[4])) { // [[...]] may be just a text
+					throw new Nette\InvalidArgumentException("File '$file' referenced in HTML is missing, is not an image or is outside of the base path.");
+				}
+			}
+
+			if ($cids[$file] === null) {
+				continue;
 			}
 
 			$html = substr_replace(
@@ -138,4 +151,21 @@ private static function embedImagesInHtml(string $html, string $basePath, Messag
 		}
 		return $html;
 	}
+
+
+	/**
+	 * Checks that the file is an image inside the base path, so that a reference in HTML
+	 * coming from untrusted content cannot embed an arbitrary file into the email.
+	 */
+	private static function isEmbeddableImage(string $file, string $basePath): bool
+	{
+		$basePath = rtrim(FileSystem::normalizePath($basePath), DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
+		if (!str_starts_with(FileSystem::normalizePath($file), $basePath) || !is_file($file)) {
+			return false;
+		}
+
+		$finfo = finfo_open(FILEINFO_MIME_TYPE);
+		$contentType = $finfo ? finfo_file($finfo, $file) : false;
+		return is_string($contentType) && str_starts_with($contentType, 'image/');
+	}
 }
diff --git a/tests/Mail/HtmlComposer.phpt b/tests/Mail/HtmlComposer.phpt
index 881f484..1b80220 100644
--- a/tests/Mail/HtmlComposer.phpt
+++ b/tests/Mail/HtmlComposer.phpt
@@ -112,6 +112,41 @@ test('embedImages() embeds local images and rewrites src to cid:', function () {
 });
 
 
+test('embedImages() fails on references to a missing file, a non-image or a file outside the base path', function () {
+	foreach (['<img src="missing.png">', '<img src="example.zip">', '<img src="../HtmlComposer.phpt">', '<img src="%2e%2e/HtmlComposer.phpt">', '<img src="../missing.png">', '<div style="background: url(../HtmlComposer.phpt)">'] as $html) {
+		Assert::exception(
+			fn() => (new HtmlComposer($html))
+				->embedImages(__DIR__ . '/fixtures')
+				->applyTo(new Message),
+			Nette\InvalidArgumentException::class,
+			"File '%a%' referenced in HTML is missing, is not an image or is outside of the base path.",
+		);
+	}
+});
+
+
+test('embedImages() leaves [[...]] of a missing file, a non-image or a file outside the base path untouched', function () {
+	$html = '<p>[[spoiler]] [[private.key]] [[../HtmlComposer.phpt]] [[../missing.png]]</p>';
+	$mail = new Message;
+	(new HtmlComposer($html))
+		->embedImages(__DIR__ . '/fixtures')
+		->applyTo($mail);
+
+	Assert::same($html, $mail->getHtmlBody());
+	Assert::notContains('Content-ID', $mail->generateMessage());
+});
+
+
+test('embedImages() embeds a path leading back into the base path', function () {
+	$mail = new Message;
+	(new HtmlComposer('<img src="../fixtures/background.png">'))
+		->embedImages(__DIR__ . '/fixtures')
+		->applyTo($mail);
+
+	Assert::match('<img src="cid:%S%@%S%">', $mail->getHtmlBody());
+});
+
+
 test('inlineCss + embedImages combined', function () {
 	$mail = new Message;
 	(new HtmlComposer('<html><body><p>Hi</p><img src="background.png"></body></html>'))