po: started research on gettext/po4a security

[git.ikiwiki.info.git] / doc / plugins / po.mdwn

diff --git a/doc/plugins/po.mdwn b/doc/plugins/po.mdwn
index 6aa63b429b1af2d8975424e3d10559e53a210fc1..39575fb63266d6cc0913999032aa9cd614256955 100644 (file)
--- a/doc/plugins/po.mdwn
+++ b/doc/plugins/po.mdwn
@@ -13,7 +13,7 @@ A language is chosen as the "master" one, and any other supported
 language is a "slave" one.
 
 A page written in the "master" language is a "master" page. It can be
 language is a "slave" one.
 
 A page written in the "master" language is a "master" page. It can be

-of any page type supported by ikiwiki, but PO. It does not have to be
+of any page type supported by ikiwiki, except `po`. It does not have to be

 named a special way: migration to this plugin does not imply any page
 renaming work.
 
 named a special way: migration to this plugin does not imply any page
 renaming work.
 


@@ -22,7 +22,7 @@ English; if `usedirs` is enabled, it is rendered as
 `bla/page/index.en.html`, else as `bla/page.en.html`.
 
 Any translation of a "master" page into a "slave" language is called
 `bla/page/index.en.html`, else as `bla/page.en.html`.
 
 Any translation of a "master" page into a "slave" language is called

-a "slave" page; it is written in the gettext PO format. PO is now
+a "slave" page; it is written in the gettext PO format. `po` is now

 a page type supported by ikiwiki.
 
 Example: `bla/page.fr.po` is the PO "message catalog" used to
 a page type supported by ikiwiki.
 
 Example: `bla/page.fr.po` is the PO "message catalog" used to


@@ -56,9 +56,8 @@ The `po_translatable_pages` setting configures what pages are
 translatable. It is a [[ikiwiki/PageSpec]], so you have lots of
 control over what kind of pages are translatable.
 
 translatable. It is a [[ikiwiki/PageSpec]], so you have lots of
 control over what kind of pages are translatable.
 

-The PO translations files are anyway not considered as being
-translatable, so you don't need to worry about excluding them
-explicitly from this [[ikiwiki/PageSpec]].
+The `.po` files are not considered as being translatable, so you don't need to
+worry about excluding them explicitly from this [[ikiwiki/PageSpec]].

 
 Internal links
 --------------
 
 Internal links
 --------------


@@ -180,17 +179,14 @@ Additional PageSpec tests
 This plugin enhances the regular [[ikiwiki/PageSpec]] syntax with some
 additional tests that are documented [[here|ikiwiki/pagespec/po]].
 
 This plugin enhances the regular [[ikiwiki/PageSpec]] syntax with some
 additional tests that are documented [[here|ikiwiki/pagespec/po]].
 

-Automatic PO files update
--------------------------
+Automatic PO file update
+------------------------

 
 Committing changes to a "master" page:
 
 
 Committing changes to a "master" page:
 

-1. updates the POT file, as well as the PO files for the "slave"
-   languages (this is done in the `needsbuild` hook); the updated PO
-   files are then put under version control;
-2. triggers a refresh of the corresponding HTML slave pages (this is
-   achieved by making any "slave" page dependent on the corresponding
-   "master" page, in the `needsbuild` hook).
+1. updates the POT file and the PO files for the "slave" languages;
+   the updated PO files are then put under version control;
+2. triggers a refresh of the corresponding HTML slave pages.

 
 Also, when the plugin has just been enabled, or when a page has just
 been declared as being translatable, the needed POT and PO files are
 
 Also, when the plugin has just been enabled, or when a page has just
 been declared as being translatable, the needed POT and PO files are


@@ -210,8 +206,8 @@ Translating
 One can edit the PO files using ikiwiki's CGI (a message-by-message
 interface could also be implemented at some point).
 
 One can edit the PO files using ikiwiki's CGI (a message-by-message
 interface could also be implemented at some point).
 

-If [[tips/untrusted_git_push]] is setup, one can edit the PO files in
-her preferred `$EDITOR`, without needing to be online.
+If [[tips/untrusted_git_push]] is setup, one can edit the PO files in one's
+preferred `$EDITOR`, without needing to be online.

 
 TODO
 ====
 
 TODO
 ====


@@ -219,10 +215,29 @@ TODO
 Security checks
 ---------------
 
 Security checks
 ---------------
 

-- `refreshpofiles` uses `system()`, whose args have to be checked more
-  thoroughly to prevent any security issue (command injection, etc.).
-- `refreshpofiles` and `refreshpot` create new files; this may need
-  some checks, e.g. using `IkiWiki::prep_writefile()`
+- Can any sort of directives be put in po files that will
+  cause mischief (ie, include other files, run commands, crash gettext,
+  whatever). The [PO file
+  format](http://www.gnu.org/software/gettext/manual/gettext.html#PO-Files)
+  should contain the answer.
+- Any security issues on running po4a on untrusted content?
+
+### Security history
+
+#### GNU gettext
+- [CVE-2004-0966](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0966)
+  / [Debian bug #278283](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278283):
+  the autopoint and gettextize scripts in the GNU gettext package
+  1.14 and later versions, as used in Trustix Secure Linux 1.5
+  through 2.1 and other operating systems, allows local users to
+  overwrite files via a symlink attack on temporary files.
+
+#### po4a
+-
+  [CVE-2007-4462](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4462):
+  lib/Locale/Po4a/Po.pm in po4a before 0.32 allows local users to
+  overwrite arbitrary files via a symlink attack on the
+  gettextization.failed.po temporary file.

 
 gettext/po4a rough corners
 --------------------------
 
 gettext/po4a rough corners
 --------------------------


@@ -242,12 +257,6 @@ gettext/po4a rough corners
 Misc. improvements
 ------------------
 
 Misc. improvements
 ------------------
 

-### automatic POT/PO update
-
-- Use the `change` hook instead of `needsbuild`?
-- Fix (apparently harmless) undefined values that pollute logs when
-  saving a master page in the CGI
-

 ### page titles
 
 Use nice page titles from meta plugin in links, as inline already
 ### page titles
 
 Use nice page titles from meta plugin in links, as inline already


@@ -255,23 +264,6 @@ does. This is actually a duplicate for
 [[bugs/pagetitle_function_does_not_respect_meta_titles]], which might
 be fixed by something like [[todo/using_meta_titles_for_parentlinks]].
 
 [[bugs/pagetitle_function_does_not_respect_meta_titles]], which might
 be fixed by something like [[todo/using_meta_titles_for_parentlinks]].
 

-### websetup
-
-Which configuration settings are safe enough for websetup?
-
-### parentlinks
-
-When the wiki home page is translatable, the parentlinks plugin sets
-`./index.html` as its translations' single parent link. Ideally, the
-home page's translations should get no parent link at all, just like
-the version written in the master language.
-
-### backlinks
-
-If a given translatable `sourcepage.mdwn` links to \[[destpage]],
-`sourcepage.LL.po` also link to \[[destpage]], and the latter has the
-master page *and* all its translations listed in the backlinks.
-

 Translation quality assurance
 -----------------------------
 
 Translation quality assurance
 -----------------------------