fix taint issue

[git.ikiwiki.info.git] / IkiWiki / Plugin / aggregate.pm

diff --git a/IkiWiki/Plugin/aggregate.pm b/IkiWiki/Plugin/aggregate.pm
index 41ca9cce0f7ff2f4029cd123102d1b04276f96f5..4bc919526f3c74de2be20b54e7ffa795186e2273 100644 (file)
--- a/IkiWiki/Plugin/aggregate.pm
+++ b/IkiWiki/Plugin/aggregate.pm
@@ -5,6 +5,10 @@ package IkiWiki::Plugin::aggregate;
 use warnings;
 use strict;
 use IkiWiki;
 use warnings;
 use strict;
 use IkiWiki;

+use HTML::Entities;
+use HTML::Parser;
+use HTML::Tagset;
+use URI;

 
 my %feeds;
 my %guids;
 
 my %feeds;
 my %guids;


@@ -31,12 +35,14 @@ sub getopt () { #{{{
 } #}}}
 
 sub checkconfig () { #{{{
 } #}}}
 
 sub checkconfig () { #{{{

+       IkiWiki::lockwiki();

        loadstate();
        if ($IkiWiki::config{aggregate}) {
                IkiWiki::loadindex();
                aggregate();
                savestate();
        }
        loadstate();
        if ($IkiWiki::config{aggregate}) {
                IkiWiki::loadindex();
                aggregate();
                savestate();
        }

+       IkiWiki::unlockwiki();

 } #}}}
 
 sub filter (@) { #{{{
 } #}}}
 
 sub filter (@) { #{{{


@@ -70,7 +76,7 @@ sub preprocess (@) { #{{{
        $feed->{name}=$name;
        $feed->{sourcepage}=$params{page};
        $feed->{url}=$params{url};
        $feed->{name}=$name;
        $feed->{sourcepage}=$params{page};
        $feed->{url}=$params{url};

-       my $dir=exists $params{dir} ? $params{dir} : IkiWiki::titlepage($params{name});
+       my $dir=exists $params{dir} ? $params{dir} : $params{page}."/".IkiWiki::titlepage($params{name});

        $dir=~s/^\/+//;
        ($dir)=$dir=~/$IkiWiki::config{wiki_file_regexp}/;
        $feed->{dir}=$dir;
        $dir=~s/^\/+//;
        ($dir)=$dir=~/$IkiWiki::config{wiki_file_regexp}/;
        $feed->{dir}=$dir;


@@ -83,6 +89,7 @@ sub preprocess (@) { #{{{
        $feed->{numposts}=0 unless defined $feed->{numposts};
        $feed->{newposts}=0 unless defined $feed->{newposts};
        $feed->{message}="new feed" unless defined $feed->{message};
        $feed->{numposts}=0 unless defined $feed->{numposts};
        $feed->{newposts}=0 unless defined $feed->{newposts};
        $feed->{message}="new feed" unless defined $feed->{message};

+       $feed->{tags}=[];

        while (@_) {
                my $key=shift;
                my $value=shift;
        while (@_) {
                my $key=shift;
                my $value=shift;


@@ -93,7 +100,7 @@ sub preprocess (@) { #{{{
 
        return "<a href=\"".$feed->{url}."\">".$feed->{name}."</a>: ".
               "<i>".$feed->{message}."</i> (".$feed->{numposts}.
 
        return "<a href=\"".$feed->{url}."\">".$feed->{name}."</a>: ".
               "<i>".$feed->{message}."</i> (".$feed->{numposts}.

-              " stored posts; ".$feed->{newposts}." new)<br />";
+              " stored posts; ".$feed->{newposts}." new)";

 } # }}}
 
 sub delete (@) { #{{{
 } # }}}
 
 sub delete (@) { #{{{


@@ -107,8 +114,6 @@ sub delete (@) { #{{{
 } #}}}
 
 sub loadstate () { #{{{
 } #}}}
 
 sub loadstate () { #{{{

-       eval q{use HTML::Entities};
-       die $@ if $@;

        if (-e "$IkiWiki::config{wikistatedir}/aggregate") {
                open (IN, "$IkiWiki::config{wikistatedir}/aggregate" ||
                        die "$IkiWiki::config{wikistatedir}/aggregate: $!");
        if (-e "$IkiWiki::config{wikistatedir}/aggregate") {
                open (IN, "$IkiWiki::config{wikistatedir}/aggregate" ||
                        die "$IkiWiki::config{wikistatedir}/aggregate: $!");


@@ -187,7 +192,8 @@ sub aggregate () { #{{{
        die $@ if $@;
 
        foreach my $feed (values %feeds) {
        die $@ if $@;
 
        foreach my $feed (values %feeds) {

-               next unless time - $feed->{lastupdate} >= $feed->{updateinterval};
+               next unless $IkiWiki::config{rebuild} || 
+                       time - $feed->{lastupdate} >= $feed->{updateinterval};

                $feed->{lastupdate}=time;
                $feed->{newposts}=0;
                $IkiWiki::forcerebuild{$feed->{sourcepage}}=1;
                $feed->{lastupdate}=time;
                $feed->{newposts}=0;
                $IkiWiki::forcerebuild{$feed->{sourcepage}}=1;


@@ -251,14 +257,17 @@ sub add_page (@) { #{{{
                $feed->{newposts}++;
 
                # assign it an unused page
                $feed->{newposts}++;
 
                # assign it an unused page

-               my $page=$feed->{dir}."/".IkiWiki::titlepage($params{title});
+               my $page=IkiWiki::titlepage($params{title});
+               # escape slashes and periods in title so it doesn't specify
+               # directory name or trigger ".." disallowing code.
+               $page=~s!([/.])!"__".ord($1)."__"!eg;
+               $page=$feed->{dir}."/".$page;

                ($page)=$page=~/$IkiWiki::config{wiki_file_regexp}/;
                if (! defined $page || ! length $page) {
                        $page=$feed->{dir}."/item";
                }
                ($page)=$page=~/$IkiWiki::config{wiki_file_regexp}/;
                if (! defined $page || ! length $page) {
                        $page=$feed->{dir}."/item";
                }

-               $page=~s/\.\.//g; # avoid ".." directory tricks

                my $c="";
                my $c="";

-               while (exists $IkiWiki::pagesources{$page.$c} ||
+               while (exists $IkiWiki::pagecase{lc $page.$c} ||

                       -e pagefile($page.$c)) {
                        $c++
                }
                       -e pagefile($page.$c)) {
                        $c++
                }


@@ -273,22 +282,22 @@ sub add_page (@) { #{{{
        eval q{use Digest::MD5 'md5_hex'};
        require Encode;
        my $digest=md5_hex(Encode::encode_utf8($params{content}));
        eval q{use Digest::MD5 'md5_hex'};
        require Encode;
        my $digest=md5_hex(Encode::encode_utf8($params{content}));

-       return unless ! exists $guid->{md5} || $guid->{md5} ne $digest;
+       return unless ! exists $guid->{md5} || $guid->{md5} ne $digest || $IkiWiki::config{rebuild};

        $guid->{md5}=$digest;
 
        # Create the page.
        my $template=IkiWiki::template("aggregatepost.tmpl", blind_cache => 1);
        $guid->{md5}=$digest;
 
        # Create the page.
        my $template=IkiWiki::template("aggregatepost.tmpl", blind_cache => 1);

-       my $content=$params{content};
-       $params{content}=~s/(?<!\\)\[\[/\\\[\[/g; # escape accidental wikilinks
-                                                 # and preprocessor stuff
-       $template->param(content => $params{content});
-       $template->param(url => $feed->{url});
+       $template->param(title => $params{title})
+               if defined $params{title} && length($params{title});
+       $template->param(content => htmlescape(htmlabs($params{content}, $feed->{feedurl})));

        $template->param(name => $feed->{name});
        $template->param(name => $feed->{name});

-       $template->param(link => $params{link}) if defined $params{link};
+       $template->param(url => $feed->{url});
+       $template->param(permalink => urlabs($params{link}, $feed->{feedurl}))
+               if defined $params{link};

        if (ref $feed->{tags}) {
                $template->param(tags => [map { tag => $_ }, @{$feed->{tags}}]);
        }
        if (ref $feed->{tags}) {
                $template->param(tags => [map { tag => $_ }, @{$feed->{tags}}]);
        }

-       IkiWiki::writefile($guid->{page}.".html", $IkiWiki::config{srcdir},
+       IkiWiki::writefile(IkiWiki::htmlpage($guid->{page}), $IkiWiki::config{srcdir},

                $template->output);
 
        # Set the mtime, this lets the build process get the right creation
                $template->output);
 
        # Set the mtime, this lets the build process get the right creation


@@ -296,6 +305,58 @@ sub add_page (@) { #{{{
        utime $mtime, $mtime, pagefile($guid->{page}) if defined $mtime;
 } #}}}
 
        utime $mtime, $mtime, pagefile($guid->{page}) if defined $mtime;
 } #}}}
 

+sub htmlescape ($) { #{{{
+       # escape accidental wikilinks and preprocessor stuff
+       my $html=shift;
+       $html=~s/(?<!\\)\[\[/\\\[\[/g;
+       return $html;
+} #}}}
+
+sub urlabs ($$) { #{{{
+       my $url=shift;
+       my $urlbase=shift;
+
+       URI->new_abs($url, $urlbase)->as_string;
+} #}}}
+
+sub htmlabs ($$) { #{{{
+       # Convert links in html from relative to absolute.
+       # Note that this is a heuristic, which is not specified by the rss
+       # spec and may not be right for all feeds. Also, see Debian
+       # bug #381359.
+       my $html=shift;
+       my $urlbase=shift;
+
+       my $ret="";
+       my $p = HTML::Parser->new(api_version => 3);
+       $p->handler(default => sub { $ret.=join("", @_) }, "text");
+       $p->handler(start => sub {
+               my ($tagname, $pos, $text) = @_;
+               if (ref $HTML::Tagset::linkElements{$tagname}) {
+                       while (4 <= @$pos) {
+                               # use attribute sets from right to left
+                               # to avoid invalidating the offsets
+                               # when replacing the values
+                               my($k_offset, $k_len, $v_offset, $v_len) =
+                                       splice(@$pos, -4);
+                               my $attrname = lc(substr($text, $k_offset, $k_len));
+                               next unless grep { $_ eq $attrname } @{$HTML::Tagset::linkElements{$tagname}};
+                               next unless $v_offset; # 0 v_offset means no value
+                               my $v = substr($text, $v_offset, $v_len);
+                               $v =~ s/^([\'\"])(.*)\1$/$2/;
+                               my $new_v=urlabs($v, $urlbase);
+                               $new_v =~ s/\"/&quot;/g; # since we quote with ""
+                               substr($text, $v_offset, $v_len) = qq("$new_v");
+                       }
+               }
+               $ret.=$text;
+       }, "tagname, tokenpos, text");
+       $p->parse($html);
+       $p->eof;
+
+       return $ret;
+} #}}}
+

 sub remove_feeds () { #{{{
        my $page=shift;
 
 sub remove_feeds () { #{{{
        my $page=shift;
 


@@ -311,7 +372,7 @@ sub remove_feeds () { #{{{
 sub pagefile ($) { #{{{
        my $page=shift;
 
 sub pagefile ($) { #{{{
        my $page=shift;
 

-       return "$IkiWiki::config{srcdir}/$page.html";
+       return "$IkiWiki::config{srcdir}/".IkiWiki::htmlpage($page);

 } #}}}
 
 1
 } #}}}
 
 1