close a possible XSS hole

[git.ikiwiki.info.git] / IkiWiki / Render.pm

diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm
index ddd14692230a749b0cee57b6396279e4f236e9bd..2c1ea3eb7c0b73f507fb51c70499f01c10c51ccc 100644 (file)
--- a/IkiWiki/Render.pm
+++ b/IkiWiki/Render.pm
@@ -20,19 +20,26 @@ sub linkify ($$$) { #{{{
        return $content;
 } #}}}
 
        return $content;
 } #}}}
 

-sub htmlize ($$) { #{{{
+sub htmlize ($$$) { #{{{
+       my $page=shift;

        my $type=shift;
        my $content=shift;
        
        if (exists $hooks{htmlize}{$type}) {
        my $type=shift;
        my $content=shift;
        
        if (exists $hooks{htmlize}{$type}) {

-               $content=$hooks{htmlize}{$type}{call}->($content);
+               $content=$hooks{htmlize}{$type}{call}->(
+                       page => $page,
+                       content => $content,
+               );

        }
        else {
                error("htmlization of $type not supported");
        }
 
        run_hooks(sanitize => sub {
        }
        else {
                error("htmlization of $type not supported");
        }
 
        run_hooks(sanitize => sub {

-               $content=shift->($content);
+               $content=shift->(
+                       page => $page,
+                       content => $content,
+               );

        });
        
        return $content;
        });
        
        return $content;


@@ -84,11 +91,11 @@ sub parentlinks ($) { #{{{
        return @ret;
 } #}}}
 
        return @ret;
 } #}}}
 

-sub preprocess ($$$;$) { #{{{
+my %preprocessing;
+sub preprocess ($$$) { #{{{

        my $page=shift; # the page the data comes from
        my $destpage=shift; # the page the data will appear in (different for inline)
        my $content=shift;
        my $page=shift; # the page the data comes from
        my $destpage=shift; # the page the data will appear in (different for inline)
        my $content=shift;

-       my $onlystrip=shift || 0; # strip directives without processing

 
        my $handle=sub {
                my $escape=shift;
 
        my $handle=sub {
                my $escape=shift;


@@ -97,33 +104,52 @@ sub preprocess ($$$;$) { #{{{
                if (length $escape) {
                        return "[[$command $params]]";
                }
                if (length $escape) {
                        return "[[$command $params]]";
                }

-               elsif ($onlystrip) {
-                       return "";
-               }

                elsif (exists $hooks{preprocess}{$command}) {
                        # Note: preserve order of params, some plugins may
                        # consider it significant.
                        my @params;
                elsif (exists $hooks{preprocess}{$command}) {
                        # Note: preserve order of params, some plugins may
                        # consider it significant.
                        my @params;

-                       while ($params =~ /(?:(\w+)=)?(?:"([^"]+)"|(\S+))(?:\s+|$)/g) {
-                               if (defined $1) {
-                                       push @params, $1, (defined $2 ? $2 : $3);
+                       while ($params =~ /(?:(\w+)=)?(?:"""(.*?)"""|"([^"]+)"|(\S+))(?:\s+|$)/sg) {
+                               my $key=$1;
+                               my $val;
+                               if (defined $2) {
+                                       $val=$2;
+                                       $val=~s/\r\n/\n/mg;
+                                       $val=~s/^\n+//g;
+                                       $val=~s/\n+$//g;
+                               }
+                               elsif (defined $3) {
+                                       $val=$3;
+                               }
+                               elsif (defined $4) {
+                                       $val=$4;
+                               }
+
+                               if (defined $key) {
+                                       push @params, $key, $val;

                                }
                                else {
                                }
                                else {

-                                       push @params, (defined $2 ? $2 : $3), '';
+                                       push @params, $val, '';

                                }
                        }
                                }
                        }

-                       return $hooks{preprocess}{$command}{call}->(
+                       if ($preprocessing{$page}++ > 3) {
+                               # Avoid loops of preprocessed pages preprocessing
+                               # other pages that preprocess them, etc.
+                               return "[[$command preprocessing loop detected on $page at depth $preprocessing{$page}]]";
+                       }
+                       my $ret=$hooks{preprocess}{$command}{call}->(

                                @params,
                                page => $page,
                                destpage => $destpage,
                        );
                                @params,
                                page => $page,
                                destpage => $destpage,
                        );

+                       $preprocessing{$page}--;
+                       return $ret;

                }
                else {
                }
                else {

-                       return "[[$command not processed]]";
+                       return "[[$command $params]]";

                }
        };
        
                }
        };
        

-       $content =~ s{(\\?)$config{wiki_processor_regexp}}{$handle->($1, $2, $3)}eg;
+       $content =~ s{(\\?)\[\[(\w+)\s+((?:(?:\w+=)?(?:""".*?"""|"[^"]+"|[^\s\]]+)\s*)*)\]\]}{$handle->($1, $2, $3)}seg;

        return $content;
 } #}}}
 
        return $content;
 } #}}}
 


@@ -190,7 +216,10 @@ sub genpage ($$$) { #{{{
        $content=$template->output;
 
        run_hooks(format => sub {
        $content=$template->output;
 
        run_hooks(format => sub {

-               $content=shift->($content);
+               $content=shift->(
+                       page => $page,
+                       content => $content,
+               );

        });
 
        return $content;
        });
 
        return $content;


@@ -266,9 +295,9 @@ sub render ($) { #{{{
                
                $links{$page}=[findlinks($page, $content)];
                
                
                $links{$page}=[findlinks($page, $content)];
                

-               $content=linkify($page, $page, $content);

                $content=preprocess($page, $page, $content);
                $content=preprocess($page, $page, $content);

-               $content=htmlize($type, $content);
+               $content=linkify($page, $page, $content);
+               $content=htmlize($page, $type, $content);

                
                check_overwrite("$config{destdir}/".htmlpage($page), $page);
                writefile(htmlpage($page), $config{destdir},
                
                check_overwrite("$config{destdir}/".htmlpage($page), $page);
                writefile(htmlpage($page), $config{destdir},