SVG filter primitives bypass remote image blocking, enabling email tracking without consent.

Summary:

When allow_remote is set to false, Roundcube's HTML sanitizer https://github.com/roundcube/roundcubemail/blob/5162a0d9d7b05728500375611a2fb4fc55844c7c/program/lib/Roundcube/rcube_washtml.php blocks external resources in <img>, <image>, and <use> tags by checking their src/href attributes through is_image_attribute().

However, the <feImage> SVG filter primitive is allowlisted as an element but its href attribute is not recognized as an image source. Instead, it passes through wash_link() which permits external HTTP/HTTPS URLs.

Steps To Reproduce:

Step 1: Send an HTML e-mail with embedded SVG