cherry-pick uri security fix

[git.ikiwiki.info.git] / IkiWiki / Plugin / meta.pm

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index adfd688a6aeece5cdf1f55b8578727ffbc111369..621e876741b288466112360b96290bac01235e52 100644 (file)
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -4,74 +4,183 @@ package IkiWiki::Plugin::meta;
 
 use warnings;
 use strict;
 
 use warnings;
 use strict;

-use IkiWiki;
+use IkiWiki 2.00;

 
 

-my %meta;
-my %title;
-my %permalink;
-my %author;
-my %authorurl;
+my %metaheaders;

 
 sub import { #{{{
 
 sub import { #{{{

-       IkiWiki::hook(type => "preprocess", id => "meta", 
-               call => \&preprocess);
-       IkiWiki::hook(type => "filter", id => "meta", 
-               call => \&filter);
-       IkiWiki::hook(type => "pagetemplate", id => "meta", 
-               call => \&pagetemplate);
+       hook(type => "needsbuild", id => "meta", call => \&needsbuild);
+       hook(type => "preprocess", id => "meta", call => \&preprocess, scan => 1);
+       hook(type => "pagetemplate", id => "meta", call => \&pagetemplate);

 } # }}}
 
 } # }}}
 

-sub filter (@) { #{{{
-       my %params=@_;
-       
-       $meta{$params{page}}='';
+sub needsbuild (@) { #{{{
+       my $needsbuild=shift;
+       foreach my $page (keys %pagestate) {
+               if (exists $pagestate{$page}{meta}) {
+                       if (exists $pagesources{$page} &&
+                           grep { $_ eq $pagesources{$page} } @$needsbuild) {
+                               # remove state, it will be re-added
+                               # if the preprocessor directive is still
+                               # there during the rebuild
+                               delete $pagestate{$page}{meta};
+                       }
+               }
+       }
+}

 
 

-       return $params{content};
-} # }}}
+sub scrub ($) { #{{{
+       if (IkiWiki::Plugin::htmlscrubber->can("sanitize")) {
+               return IkiWiki::Plugin::htmlscrubber::sanitize(content => shift);
+       }
+       else {
+               return shift;
+       }
+} #}}}
+
+sub htmlize ($$$) { #{{{
+       my $page = shift;
+       my $destpage = shift;
+
+       return IkiWiki::htmlize($page, pagetype($pagesources{$page}),
+               IkiWiki::linkify($page, $destpage,
+               IkiWiki::preprocess($page, $destpage, shift)));
+}

 
 sub preprocess (@) { #{{{
 
 sub preprocess (@) { #{{{

-       if (! @_) {
-               return "";
-       }
+       return "" unless @_;

        my %params=@_;
        my $key=shift;
        my $value=$params{$key};
        delete $params{$key};
        my $page=$params{page};
        delete $params{page};
        my %params=@_;
        my $key=shift;
        my $value=$params{$key};
        delete $params{$key};
        my $page=$params{page};
        delete $params{page};

+       my $destpage=$params{destpage};

        delete $params{destpage};
        delete $params{destpage};

+       delete $params{preview};

 
        eval q{use HTML::Entities};
 
        eval q{use HTML::Entities};

-       # Always dencode, even if encoding later, since it might not be
+       # Always decode, even if encoding later, since it might not be

        # fully encoded.
        $value=decode_entities($value);
 
        # fully encoded.
        $value=decode_entities($value);
 

-       if ($key eq 'link') {
-               if (%params) {
-                       $meta{$page}.="<link href=\"".encode_entities($value)."\" ".
-                               join(" ", map { encode_entities($_)."=\"".encode_entities(decode_entities($params{$_}))."\"" } keys %params).
-                               " />\n";
-               }
-               else {
-                       # hidden WikiLink
-                       push @{$IkiWiki::links{$page}}, $value;
-               }
+       # Metadata collection that needs to happen during the scan pass.
+       if ($key eq 'title') {
+               $pagestate{$page}{meta}{title}=HTML::Entities::encode_numeric($value);

        }
        }

-       elsif ($key eq 'title') {
-               $title{$page}=$value;
+       elsif ($key eq 'license') {
+               push @{$metaheaders{$page}}, '<link rel="license" href="#page_license" />';
+               $pagestate{$page}{meta}{license}=$value;
+               return "";
+       }
+       elsif ($key eq 'copyright') {
+               push @{$metaheaders{$page}}, '<link rel="copyright" href="#page_copyright" />';
+               $pagestate{$page}{meta}{copyright}=$value;
+               return "";
+       }
+       elsif ($key eq 'link' && ! %params) {
+               # hidden WikiLink
+               push @{$links{$page}}, $value;
+               return "";
+       }
+       elsif ($key eq 'author') {
+               $pagestate{$page}{meta}{author}=$value;
+               # fallthorough
+       }
+       elsif ($key eq 'authorurl') {
+               $pagestate{$page}{meta}{authorurl}=$value;
+               # fallthrough
+       }
+
+       if (! defined wantarray) {
+               # avoid collecting duplicate data during scan pass
+               return;
+       }
+
+       # Metadata collection that happens only during preprocessing pass.
+       if ($key eq 'date') {
+               eval q{use Date::Parse};
+               if (! $@) {
+                       my $time = str2time($value);
+                       $IkiWiki::pagectime{$page}=$time if defined $time;
+               }

        }
        elsif ($key eq 'permalink') {
        }
        elsif ($key eq 'permalink') {

-               $permalink{$page}=$value;
+               $pagestate{$page}{meta}{permalink}=$value;
+               push @{$metaheaders{$page}}, scrub('<link rel="bookmark" href="'.encode_entities($value).'" />');

        }
        }

-       else {
-               $meta{$page}.="<meta name=\"".encode_entities($key).
-                       "\" content=\"".encode_entities($value)."\" />\n";
-               if ($key eq 'author') {
-                       $author{$page}=$value;
+       elsif ($key eq 'stylesheet') {
+               my $rel=exists $params{rel} ? $params{rel} : "alternate stylesheet";
+               my $title=exists $params{title} ? $params{title} : $value;
+               # adding .css to the value prevents using any old web
+               # editable page as a stylesheet
+               my $stylesheet=bestlink($page, $value.".css");
+               if (! length $stylesheet) {
+                       return "[[meta ".gettext("stylesheet not found")."]]";

                }
                }

-               elsif ($key eq 'authorurl') {
-                       $authorurl{$page}=$value;
+               push @{$metaheaders{$page}}, '<link href="'.urlto($stylesheet, $page).
+                       '" rel="'.encode_entities($rel).
+                       '" title="'.encode_entities($title).
+                       "\" type=\"text/css\" />";
+       }
+       elsif ($key eq 'openid') {
+               if (exists $params{server}) {
+                       push @{$metaheaders{$page}}, '<link href="'.encode_entities($params{server}).
+                               '" rel="openid.server" />';

                }
                }

+               push @{$metaheaders{$page}}, '<link href="'.encode_entities($value).
+                       '" rel="openid.delegate" />';
+       }
+       elsif ($key eq 'redir') {
+               return "" if $page ne $destpage;
+               my $safe=0;
+               if ($value !~ /^\w+:\/\//) {
+                       my ($redir_page, $redir_anchor) = split /\#/, $value;
+
+                       add_depends($page, $redir_page);
+                       my $link=bestlink($page, $redir_page);
+                       if (! length $link) {
+                               return "[[meta ".gettext("redir page not found")."]]";
+                       }
+
+                       $value=urlto($link, $page);
+                       $value.='#'.$redir_anchor if defined $redir_anchor;
+                       $safe=1;
+
+                       # redir cycle detection
+                       $pagestate{$page}{meta}{redir}=$link;
+                       my $at=$page;
+                       my %seen;
+                       while (exists $pagestate{$at}{meta}{redir}) {
+                               if ($seen{$at}) {
+                                       return "[[meta ".gettext("redir cycle is not allowed")."]]";
+                               }
+                               $seen{$at}=1;
+                               $at=$pagestate{$at}{meta}{redir};
+                       }
+               }
+               else {
+                       $value=encode_entities($value);
+               }
+               my $delay=int(exists $params{delay} ? $params{delay} : 0);
+               my $redir="<meta http-equiv=\"refresh\" content=\"$delay; URL=$value\">";
+               if (! $safe) {
+                       $redir=scrub($redir);
+               }
+               push @{$metaheaders{$page}}, $redir;
+       }
+       elsif ($key eq 'link') {
+               if (%params) {
+                       push @{$metaheaders{$page}}, scrub("<link href=\"".encode_entities($value)."\" ".
+                               join(" ", map {
+                                       encode_entities($_)."=\"".encode_entities(decode_entities($params{$_}))."\""
+                               } keys %params).
+                               " />\n");
+               }
+       }
+       else {
+               push @{$metaheaders{$page}}, scrub('<meta name="'.encode_entities($key).
+                       '" content="'.encode_entities($value).'" />');

        }
 
        return "";
        }
 
        return "";


@@ -80,19 +189,83 @@ sub preprocess (@) { #{{{
 sub pagetemplate (@) { #{{{
        my %params=@_;
         my $page=$params{page};
 sub pagetemplate (@) { #{{{
        my %params=@_;
         my $page=$params{page};

+        my $destpage=$params{destpage};

         my $template=$params{template};
 
         my $template=$params{template};
 

-       $template->param(meta => $meta{$page})
-               if exists $meta{$page} && $template->query(name => "meta");
-       $template->param(title => $title{$page})
-               if exists $title{$page} && $template->query(name => "title");
-       $template->param(permalink => $permalink{$page})
-               if exists $permalink{$page} && $template->query(name => "permalink");
-       $template->param(author => $author{$page})
-               if exists $author{$page} && $template->query(name => "author");
-       $template->param(authorurl => $authorurl{$page})
-               if exists $authorurl{$page} && $template->query(name => "authorurl");
-       
+       if (exists $metaheaders{$page} && $template->query(name => "meta")) {
+               # avoid duplicate meta lines
+               my %seen;
+               $template->param(meta => join("\n", grep { (! $seen{$_}) && ($seen{$_}=1) } @{$metaheaders{$page}}));
+       }
+       if (exists $pagestate{$page}{meta}{title} && $template->query(name => "title")) {
+               $template->param(title => $pagestate{$page}{meta}{title});
+               $template->param(title_overridden => 1);
+       }
+
+       foreach my $field (qw{author authorurl permalink}) {
+               $template->param($field => $pagestate{$page}{meta}{$field})
+                       if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
+       }
+
+       foreach my $field (qw{license copyright}) {
+               if (exists $pagestate{$page}{meta}{$field} && $template->query(name => $field) &&
+                   ($page eq $destpage || ! exists $pagestate{$destpage}{meta}{$field} ||
+                    $pagestate{$page}{meta}{$field} ne $pagestate{$destpage}{meta}{$field})) {
+                       $template->param($field => htmlize($page, $destpage, $pagestate{$page}{meta}{$field}));
+               }
+       }

 } # }}}
 
 } # }}}
 

+sub match { #{{{
+       my $field=shift;
+       my $page=shift;
+       
+       # turn glob into a safe regexp
+       my $re=quotemeta(shift);
+       $re=~s/\\\*/.*/g;
+       $re=~s/\\\?/./g;
+
+       my $val;
+       if (exists $pagestate{$page}{meta}{$field}) {
+               $val=$pagestate{$page}{meta}{$field};
+       }
+       elsif ($field eq 'title') {
+               $val=pagetitle($page);
+       }
+
+       if (defined $val) {
+               if ($val=~/^$re$/i) {
+                       return IkiWiki::SuccessReason->new("$re matches $field of $page");
+               }
+               else {
+                       return IkiWiki::FailReason->new("$re does not match $field of $page");
+               }
+       }
+       else {
+               return IkiWiki::FailReason->new("$page does not have a $field");
+       }
+} #}}}
+
+package IkiWiki::PageSpec;
+
+sub match_title ($$;@) { #{{{
+       IkiWiki::Plugin::meta::match("title", @_);      
+} #}}}
+
+sub match_author ($$;@) { #{{{
+       IkiWiki::Plugin::meta::match("author", @_);
+} #}}}
+
+sub match_authorurl ($$;@) { #{{{
+       IkiWiki::Plugin::meta::match("authorurl", @_);
+} #}}}
+
+sub match_license ($$;@) { #{{{
+       IkiWiki::Plugin::meta::match("license", @_);
+} #}}}
+
+sub match_copyright ($$;@) { #{{{
+       IkiWiki::Plugin::meta::match("copyright", @_);
+} #}}}
+

 1
 1