diff --git a/lib/email/styles.rb b/lib/email/styles.rb index 9186bb3f137..cb20f3dca18 100644 --- a/lib/email/styles.rb +++ b/lib/email/styles.rb @@ -129,13 +129,18 @@ module Email # iframes can't go in emails, so replace them with clickable links @fragment.css('iframe').each do |i| begin - src_uri = URI(i['src']) + # sometimes, iframes are blacklisted... + if i["src"].blank? + i.remove + next + end + src_uri = URI(i['src']) # If an iframe is protocol relative, use SSL when displaying it display_src = "#{src_uri.scheme || 'https'}://#{src_uri.host}#{src_uri.path}#{src_uri.query.nil? ? '' : '?' + src_uri.query}#{src_uri.fragment.nil? ? '' : '#' + src_uri.fragment}" i.replace "

#{CGI.escapeHTML(display_src)}

" rescue URI::InvalidURIError - # If the URL is weird, remove it + # If the URL is weird, remove the iframe i.remove end end diff --git a/spec/components/email/styles_spec.rb b/spec/components/email/styles_spec.rb index d9824f4cf7a..97e09c726c5 100644 --- a/spec/components/email/styles_spec.rb +++ b/spec/components/email/styles_spec.rb @@ -95,6 +95,12 @@ describe Email::Styles do expect(frag.at('iframe')).to be_blank expect(frag.at('a')).to be_blank end + + it "won't allow empty iframe src, strips them with no link" do + frag = html_fragment("") + expect(frag.at('iframe')).to be_blank + expect(frag.at('a')).to be_blank + end end context "rewriting protocol relative URLs to the forum" do