Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes

Summary:

The style sanitizer in Roundcube Webmail can be bypassed by creating HTML entities using CSS character escapes. This allows using arbitrary inline CSS, like e.g. url(), and retrieve the IP address and user agent of the person reading the email.

Steps To Reproduce:

1. Send an HTML email to your account with the following contents:

<div style='content: "\0026quot;; background: url(//http.cat/418); content:""; width: 100%; height: 100%;'>hi, this shouldn't work :(</div>

2. Open the email in Roundcube in the HTML mode