fix taint issue

[git.ikiwiki.info.git] / IkiWiki / Plugin / aggregate.pm

diff --git a/IkiWiki/Plugin/aggregate.pm b/IkiWiki/Plugin/aggregate.pm
index 14461059d560774fdead466be1ebfb052c9ed1ee..4bc919526f3c74de2be20b54e7ffa795186e2273 100644 (file)
--- a/IkiWiki/Plugin/aggregate.pm
+++ b/IkiWiki/Plugin/aggregate.pm
@@ -5,6 +5,10 @@ package IkiWiki::Plugin::aggregate;
 use warnings;
 use strict;
 use IkiWiki;
+use HTML::Entities;
+use HTML::Parser;
+use HTML::Tagset;
+use URI;
 
 my %feeds;
 my %guids;
@@ -31,12 +35,14 @@ sub getopt () { #{{{
 } #}}}
 
 sub checkconfig () { #{{{
+       IkiWiki::lockwiki();
        loadstate();
        if ($IkiWiki::config{aggregate}) {
                IkiWiki::loadindex();
                aggregate();
                savestate();
        }
+       IkiWiki::unlockwiki();
 } #}}}
 
 sub filter (@) { #{{{
@@ -70,7 +76,7 @@ sub preprocess (@) { #{{{
        $feed->{name}=$name;
        $feed->{sourcepage}=$params{page};
        $feed->{url}=$params{url};
-       my $dir=exists $params{dir} ? $params{dir} : "feed/".IkiWiki::titlepage($params{name});
+       my $dir=exists $params{dir} ? $params{dir} : $params{page}."/".IkiWiki::titlepage($params{name});
        $dir=~s/^\/+//;
        ($dir)=$dir=~/$IkiWiki::config{wiki_file_regexp}/;
        $feed->{dir}=$dir;
@@ -94,7 +100,7 @@ sub preprocess (@) { #{{{
 
        return "<a href=\"".$feed->{url}."\">".$feed->{name}."</a>: ".
               "<i>".$feed->{message}."</i> (".$feed->{numposts}.
-              " stored posts; ".$feed->{newposts}." new)<br />";
+              " stored posts; ".$feed->{newposts}." new)";
 } # }}}
 
 sub delete (@) { #{{{
@@ -108,8 +114,6 @@ sub delete (@) { #{{{
 } #}}}
 
 sub loadstate () { #{{{
-       eval q{use HTML::Entities};
-       die $@ if $@;
        if (-e "$IkiWiki::config{wikistatedir}/aggregate") {
                open (IN, "$IkiWiki::config{wikistatedir}/aggregate" ||
                        die "$IkiWiki::config{wikistatedir}/aggregate: $!");
@@ -258,13 +262,12 @@ sub add_page (@) { #{{{
                # directory name or trigger ".." disallowing code.
                $page=~s!([/.])!"__".ord($1)."__"!eg;
                $page=$feed->{dir}."/".$page;
-               $page=lc($page);
                ($page)=$page=~/$IkiWiki::config{wiki_file_regexp}/;
                if (! defined $page || ! length $page) {
                        $page=$feed->{dir}."/item";
                }
                my $c="";
-               while (exists $IkiWiki::pagesources{$page.$c} ||
+               while (exists $IkiWiki::pagecase{lc $page.$c} ||
                       -e pagefile($page.$c)) {
                        $c++
                }
@@ -284,19 +287,17 @@ sub add_page (@) { #{{{
 
        # Create the page.
        my $template=IkiWiki::template("aggregatepost.tmpl", blind_cache => 1);
-       my $content=$params{content};
-       $params{content}=~s/(?<!\\)\[\[/\\\[\[/g; # escape accidental wikilinks
-                                                 # and preprocessor stuff
        $template->param(title => $params{title})
                if defined $params{title} && length($params{title});
-       $template->param(content => $params{content});
-       $template->param(url => $feed->{url});
+       $template->param(content => htmlescape(htmlabs($params{content}, $feed->{feedurl})));
        $template->param(name => $feed->{name});
-       $template->param(link => $params{link}) if defined $params{link};
+       $template->param(url => $feed->{url});
+       $template->param(permalink => urlabs($params{link}, $feed->{feedurl}))
+               if defined $params{link};
        if (ref $feed->{tags}) {
                $template->param(tags => [map { tag => $_ }, @{$feed->{tags}}]);
        }
-       IkiWiki::writefile($guid->{page}.".html", $IkiWiki::config{srcdir},
+       IkiWiki::writefile(IkiWiki::htmlpage($guid->{page}), $IkiWiki::config{srcdir},
                $template->output);
 
        # Set the mtime, this lets the build process get the right creation
@@ -304,6 +305,58 @@ sub add_page (@) { #{{{
        utime $mtime, $mtime, pagefile($guid->{page}) if defined $mtime;
 } #}}}
 
+sub htmlescape ($) { #{{{
+       # escape accidental wikilinks and preprocessor stuff
+       my $html=shift;
+       $html=~s/(?<!\\)\[\[/\\\[\[/g;
+       return $html;
+} #}}}
+
+sub urlabs ($$) { #{{{
+       my $url=shift;
+       my $urlbase=shift;
+
+       URI->new_abs($url, $urlbase)->as_string;
+} #}}}
+
+sub htmlabs ($$) { #{{{
+       # Convert links in html from relative to absolute.
+       # Note that this is a heuristic, which is not specified by the rss
+       # spec and may not be right for all feeds. Also, see Debian
+       # bug #381359.
+       my $html=shift;
+       my $urlbase=shift;
+
+       my $ret="";
+       my $p = HTML::Parser->new(api_version => 3);
+       $p->handler(default => sub { $ret.=join("", @_) }, "text");
+       $p->handler(start => sub {
+               my ($tagname, $pos, $text) = @_;
+               if (ref $HTML::Tagset::linkElements{$tagname}) {
+                       while (4 <= @$pos) {
+                               # use attribute sets from right to left
+                               # to avoid invalidating the offsets
+                               # when replacing the values
+                               my($k_offset, $k_len, $v_offset, $v_len) =
+                                       splice(@$pos, -4);
+                               my $attrname = lc(substr($text, $k_offset, $k_len));
+                               next unless grep { $_ eq $attrname } @{$HTML::Tagset::linkElements{$tagname}};
+                               next unless $v_offset; # 0 v_offset means no value
+                               my $v = substr($text, $v_offset, $v_len);
+                               $v =~ s/^([\'\"])(.*)\1$/$2/;
+                               my $new_v=urlabs($v, $urlbase);
+                               $new_v =~ s/\"/&quot;/g; # since we quote with ""
+                               substr($text, $v_offset, $v_len) = qq("$new_v");
+                       }
+               }
+               $ret.=$text;
+       }, "tagname, tokenpos, text");
+       $p->parse($html);
+       $p->eof;
+
+       return $ret;
+} #}}}
+
 sub remove_feeds () { #{{{
        my $page=shift;
 
@@ -319,7 +372,7 @@ sub remove_feeds () { #{{{
 sub pagefile ($) { #{{{
        my $page=shift;
 
-       return "$IkiWiki::config{srcdir}/$page.html";
+       return "$IkiWiki::config{srcdir}/".IkiWiki::htmlpage($page);
 } #}}}
 
 1