Exclude working directory from library path (CVE-2016-1238)

[git.ikiwiki.info.git] / doc / plugins / contrib / bibtex2html.mdwn

diff --git a/doc/plugins/contrib/bibtex2html.mdwn b/doc/plugins/contrib/bibtex2html.mdwn
index b2e95a263c7debc0d852e17946333fc4a0bf5ba4..fc3034326a056ffc5444126b4a2e24debceabe95 100644 (file)
--- a/doc/plugins/contrib/bibtex2html.mdwn
+++ b/doc/plugins/contrib/bibtex2html.mdwn
@@ -1,8 +1,9 @@
 [[!template id=plugin name=bibtex2html author="[[anarcat]]"]]
 [[!template id=plugin name=bibtex2html author="[[anarcat]]"]]

+[[!tag type/format]]

 
 

-Trivial plugin to implement [[todo/BibTeX]] support simply using [bibtex2html](https://www.lri.fr/~filliatr/bibtex2html/). It is hopefully secure enough, but I have still marked it as unsafe because I am worried about parameter expansion in bibtex calls from bibtex2html that wouldn't escape those characters properly. The pipeline is called safely, but certain `-flags` could be maliciously added to the filenames somehow.
+Trivial plugin to implement [[todo/BibTeX]] support simply using [bibtex2html](https://www.lri.fr/~filliatr/bibtex2html/). It only takes a `bib` file as an argument and dumps whatever bibtex2html returns for it, so it shows *all* the entries, something that is not really possible with the existing [[bibtex]] plugin, as that one requires you to explicitly state every citation you want to show.

 
 

-The plugin is generic enough that I wonder if there's a level of abstraction that exists here that I have missed. If not it would be interesting to add.
+It is hopefully secure enough, but I have still marked it as unsafe because I am worried about parameter expansion in bibtex calls from bibtex2html that wouldn't escape those characters properly. The pipeline is called safely, but certain `-flags` could be maliciously added to the filenames somehow.

 
 [[!format perl """
 #!/usr/bin/perl
 
 [[!format perl """
 #!/usr/bin/perl


@@ -43,7 +44,7 @@ sub bibtex2html {
     }
     add_depends($params{page}, $near);
     $near = srcfile($near);
     }
     add_depends($params{page}, $near);
     $near = srcfile($near);

-    my @bibtex_cmd = (qw[bibtex2html -charset utf-8 -noheader -nofooter -nobibsource -nodoc -q -o -], $near);
+    my @bibtex_cmd = (qw[bibtex2html -noheader -nofooter -nobibsource -nodoc -q -o -], $near);

     
     open(PIPE, "-|", @bibtex_cmd)
         || error "can't open pipe to @bibtex_cmd: $!";
     
     open(PIPE, "-|", @bibtex_cmd)
         || error "can't open pipe to @bibtex_cmd: $!";


@@ -55,3 +56,9 @@ sub bibtex2html {
 
 1;
 """]]
 
 1;
 """]]

+
+This could be extended to process `.bib` files directly as source files instead of injecting them in the HTML like this.
+
+The plugin is generic enough that it could be abstracted to do more than just `bibtex2html`, in a manner similar to the [[compile]] plugin. Unfortunately, the [[compile]] plugin gives too much power to the user providing input to the wiki, which can modify even the commands being run in the directives. There is therefore some room here to make generic preprocessor or even htmlize plugin that would take a hash of `extension` -> `command` configuration to turn (say) `.bib` or `.tex` files into HTML or PDF or whatever you fancy.
+
+Obviously, this very plugin should have been implemented with Text::Bibtex because forking to `bibtex2html` is expensive. Yet I haven't found a way to do what this plugin does with the existing [[bibtex]] module. [[bibtex]] could of course be extended and then render this plugin obsolete, but I have found it simpler to just reuse an existing working rendered than rewrite my own in Perl. --[[anarcat]]