]> git.donarmstrong.com Git - debbugs.git/blob - Debbugs/CGI/Bugreport.pm
Linkify CVE reports (closes: #568464). Thanks to Martin Zobel-Helas.
[debbugs.git] / Debbugs / CGI / Bugreport.pm
1 # This module is part of debbugs, and is released
2 # under the terms of the GPL version 2, or any later version. See the
3 # file README and COPYING for more information.
4 #
5 # [Other people have contributed to this file; their copyrights should
6 # be listed here too.]
7 # Copyright 2008 by Don Armstrong <don@donarmstrong.com>.
8
9
10 package Debbugs::CGI::Bugreport;
11
12 =head1 NAME
13
14 Debbugs::CGI::Bugreport -- specific routines for the bugreport cgi script
15
16 =head1 SYNOPSIS
17
18
19 =head1 DESCRIPTION
20
21
22 =head1 BUGS
23
24 None known.
25
26 =cut
27
28 use warnings;
29 use strict;
30 use vars qw($VERSION $DEBUG %EXPORT_TAGS @EXPORT_OK @EXPORT);
31 use base qw(Exporter);
32
33 use IO::Scalar;
34 use Params::Validate qw(validate_with :types);
35 use Debbugs::MIME qw(convert_to_utf8 decode_rfc1522 create_mime_message);
36 use Debbugs::CGI qw(:url :html :util);
37 use Debbugs::Common qw(globify_scalar english_join);
38 use POSIX qw(strftime);
39
40 BEGIN{
41      ($VERSION) = q$Revision: 494 $ =~ /^Revision:\s+([^\s+])/;
42      $DEBUG = 0 unless defined $DEBUG;
43
44      @EXPORT = ();
45      %EXPORT_TAGS = ();
46      @EXPORT_OK = (qw(display_entity handle_record handle_email_message));
47      Exporter::export_ok_tags(keys %EXPORT_TAGS);
48      $EXPORT_TAGS{all} = [@EXPORT_OK];
49 }
50
51
52
53 =head2 display_entity
54
55      display_entity(entity      => $entity,
56                     bug_num     => $ref,
57                     outer       => 1,
58                     msg_num     => $msg_num,
59                     attachments => \@attachments,
60                     output      => \$output);
61
62
63 =over
64
65 =item entity -- MIME::Parser entity
66
67 =item bug_num -- Bug number
68
69 =item outer -- Whether this is the outer entity; defaults to 1
70
71 =item msg_num -- message number in the log
72
73 =item attachments -- arrayref of attachments
74
75 =item output -- scalar reference for output
76
77 =back
78
79 =cut
80
81 sub display_entity {
82     my %param = validate_with(params => \@_,
83                               spec   => {entity      => {type => OBJECT,
84                                                         },
85                                          bug_num     => {type => SCALAR,
86                                                          regex => qr/^\d+$/,
87                                                         },
88                                          outer       => {type => BOOLEAN,
89                                                          default => 1,
90                                                         },
91                                          msg_num     => {type => SCALAR,
92                                                         },
93                                          attachments => {type => ARRAYREF,
94                                                          default => [],
95                                                         },
96                                          output      => {type => SCALARREF|HANDLE,
97                                                          default => \*STDOUT,
98                                                         },
99                                          terse       => {type => BOOLEAN,
100                                                          default => 0,
101                                                         },
102                                          msg         => {type => SCALAR,
103                                                          optional => 1,
104                                                         },
105                                          att         => {type => SCALAR,
106                                                          optional => 1,
107                                                         },
108                                          trim_headers => {type => BOOLEAN,
109                                                           default => 1,
110                                                          },
111                                         }
112                              );
113
114     $param{output} = globify_scalar($param{output});
115     my $entity = $param{entity};
116     my $ref = $param{bug_num};
117     my $top = $param{outer};
118     my $xmessage = $param{msg_num};
119     my $attachments = $param{attachments};
120
121     my $head = $entity->head;
122     my $disposition = $head->mime_attr('content-disposition');
123     $disposition = 'inline' if not defined $disposition or $disposition eq '';
124     my $type = $entity->effective_type;
125     my $filename = $entity->head->recommended_filename;
126     $filename = '' unless defined $filename;
127     $filename = decode_rfc1522($filename);
128
129     if ($param{outer} and
130         not $param{terse} and
131         not exists $param{att}) {
132          my $header = $entity->head;
133          print {$param{output}} "<pre class=\"headers\">\n";
134          if ($param{trim_headers}) {
135               my @headers;
136               foreach (qw(From To Cc Subject Date)) {
137                    my $head_field = $head->get($_);
138                    next unless defined $head_field and $head_field ne '';
139                    push @headers, qq(<b>$_:</b> ) . html_escape(decode_rfc1522($head_field));
140               }
141               print {$param{output}} join(qq(), @headers);
142          } else {
143               print {$param{output}} html_escape(decode_rfc1522($entity->head->stringify));
144          }
145          print {$param{output}} "</pre>\n";
146     }
147
148     if (not (($param{outer} and $type =~ m{^text(?:/plain)?(?:;|$)})
149              or $type =~ m{^multipart/}
150             )) {
151         push @$attachments, $param{entity};
152         # output this attachment
153         if (exists $param{att} and
154             $param{att} == $#$attachments) {
155             my $head = $entity->head;
156             chomp(my $type = $entity->effective_type);
157             my $body = $entity->stringify_body;
158             print {$param{output}} "Content-Type: $type";
159             my ($charset) = $head->get('Content-Type:') =~ m/charset\s*=\s*\"?([\w-]+)\"?/i;
160             print {$param{output}} qq(; charset="$charset") if defined $charset;
161             print {$param{output}}"\n";
162             if ($filename ne '') {
163                 my $qf = $filename;
164                 $qf =~ s/"/\\"/g;
165                 $qf =~ s[.*/][];
166                 print {$param{output}} qq{Content-Disposition: inline; filename="$qf"\n};
167             }
168             print {$param{output}} "\n";
169             my $decoder = MIME::Decoder->new($head->mime_encoding);
170             $decoder->decode(IO::Scalar->new(\$body), $param{output});
171             return;
172         }
173         elsif (not exists $param{att}) {
174              my @dlargs = (msg=>$xmessage, att=>$#$attachments);
175              push @dlargs, (filename=>$filename) if $filename ne '';
176              my $printname = $filename;
177              $printname = 'Message part ' . ($#$attachments + 1) if $filename eq '';
178              print {$param{output}} '<pre class="mime">[<a href="' .
179                   html_escape(bug_links(bug => $ref,
180                                         links_only => 1,
181                                         options => {@dlargs})
182                              ) . qq{">$printname</a> } .
183                                   "($type, $disposition)]</pre>\n";
184         }
185     }
186
187     return if not $param{outer} and $disposition eq 'attachment' and not exists $param{att};
188     return unless ($type =~ m[^text/?] and
189                    $type !~ m[^text/(?:html|enriched)(?:;|$)]) or
190                   $type =~ m[^application/pgp(?:;|$)] or
191                   $entity->parts;
192
193     if ($entity->is_multipart) {
194         my @parts = $entity->parts;
195         foreach my $part (@parts) {
196             display_entity(entity => $part,
197                            bug_num => $ref,
198                            outer => 0,
199                            msg_num => $xmessage,
200                            output => $param{output},
201                            attachments => $attachments,
202                            terse => $param{terse},
203                            exists $param{msg}?(msg=>$param{msg}):(),
204                            exists $param{att}?(att=>$param{att}):(),
205                           );
206             # print {$param{output}} "\n";
207         }
208     } elsif ($entity->parts) {
209         # We must be dealing with a nested message.
210          if (not exists $param{att}) {
211               print {$param{output}} "<blockquote>\n";
212          }
213         my @parts = $entity->parts;
214         foreach my $part (@parts) {
215             display_entity(entity => $part,
216                            bug_num => $ref,
217                            outer => 1,
218                            msg_num => $xmessage,
219                            output => $param{output},
220                            attachments => $attachments,
221                            terse => $param{terse},
222                            exists $param{msg}?(msg=>$param{msg}):(),
223                            exists $param{att}?(att=>$param{att}):(),
224                           );
225             # print {$param{output}} "\n";
226         }
227          if (not exists $param{att}) {
228               print {$param{output}} "</blockquote>\n";
229          }
230     } elsif (not $param{terse}) {
231          my $content_type = $entity->head->get('Content-Type:') || "text/html";
232          my ($charset) = $content_type =~ m/charset\s*=\s*\"?([\w-]+)\"?/i;
233          my $body = $entity->bodyhandle->as_string;
234          $body = convert_to_utf8($body,$charset) if defined $charset;
235          $body = html_escape($body);
236          # Attempt to deal with format=flowed
237          if ($content_type =~ m/format\s*=\s*\"?flowed\"?/i) {
238               $body =~ s{^\ }{}mgo;
239               # we ignore the other things that you can do with
240               # flowed e-mails cause they don't really matter.
241          }
242          # Add links to URLs
243          # We don't html escape here because we escape above;
244          # wierd terminators are because of that
245          $body =~ s{((?:ftp|http|https|svn|ftps|rsync)://[\S~-]+?/?) # Url
246                     ((?:\&gt\;)?[)]?(?:'|\&\#39\;)?[:.\,]?(?:\s|$)) # terminators
247               }{<a href=\"$1\">$1</a>$2}gox;
248          # Add links to bug closures
249          $body =~ s[(closes:\s*(?:bug)?\#?\s?\d+(?:,?\s*(?:bug)?\#?\s?\d+)*)]
250                    [my $temp = $1;
251                     $temp =~ s{(\d+)}
252                               {bug_links(bug=>$1)}ge;
253                     $temp;]gxie;
254          if (defined $config{cve_tracker} and
255              length $config{cve_tracker}
256             ) {
257              # Add links to CVE vulnerabilities (closes #568464)
258              $body =~ s{(CVE-\d{4}-\d{4,})}
259                        {<a href="http://$config{cve_tracker}$1">$1</a>}gx;
260          }
261          if (not exists $param{att}) {
262               print {$param{output}} qq(<pre class="message">$body</pre>\n);
263          }
264     }
265 }
266
267
268 =head2 handle_email_message
269
270      handle_email_message($record->{text},
271                           ref        => $bug_number,
272                           msg_num => $msg_number,
273                          );
274
275 Returns a decoded e-mail message and displays entities/attachments as
276 appropriate.
277
278
279 =cut
280
281 sub handle_email_message{
282      my ($email,%param) = @_;
283
284      my $output = '';
285      my $parser = MIME::Parser->new();
286      # Because we are using memory, not tempfiles, there's no need to
287      # clean up here like in Debbugs::MIME
288      $parser->tmp_to_core(1);
289      $parser->output_to_core(1);
290      my $entity = $parser->parse_data( $email);
291      my @attachments = ();
292      display_entity(entity  => $entity,
293                     bug_num => $param{ref},
294                     outer   => 1,
295                     msg_num => $param{msg_num},
296                     output => \$output,
297                     attachments => \@attachments,
298                     terse       => $param{terse},
299                     exists $param{msg}?(msg=>$param{msg}):(),
300                     exists $param{att}?(att=>$param{att}):(),
301                     exists $param{trim_headers}?(trim_headers=>$param{trim_headers}):(),
302                    );
303      return $output;
304
305 }
306
307 =head2 handle_record
308
309      push @log, handle_record($record,$ref,$msg_num);
310
311 Deals with a record in a bug log as returned by
312 L<Debbugs::Log::read_log_records>; returns the log information that
313 should be output to the browser.
314
315 =cut
316
317 sub handle_record{
318      my ($record,$bug_number,$msg_number,$seen_msg_ids) = @_;
319
320      my $output = '';
321      local $_ = $record->{type};
322      if (/html/) {
323           my ($time) = $record->{text} =~ /<!--\s+time:(\d+)\s+-->/;
324           my $class = $record->{text} =~ /^<strong>(?:Acknowledgement|Reply|Information|Report|Notification)/m ? 'infmessage':'msgreceived';
325           $output .= decode_rfc1522($record->{text});
326           # Link to forwarded http:// urls in the midst of the report
327           # (even though these links already exist at the top)
328           $output =~ s,((?:ftp|http|https)://[\S~-]+?/?)((?:[\)\'\:\.\,]|\&\#39;)?(?:\s|\.<|$)),<a href=\"$1\">$1</a>$2,go;
329           # Add links to the cloned bugs
330           $output =~ s{(Bug )(\d+)( cloned as bugs? )(\d+)(?:\-(\d+)|)}{$1.bug_links(bug=>$2).$3.bug_links(bug=>(defined $5)?[$4..$5]:$4)}eo;
331           # Add links to merged bugs
332           $output =~ s{(?<=Merged )([\d\s]+)(?=\.)}{join(' ',map {bug_links(bug=>$_)} (split /\s+/, $1))}eo;
333           # Add links to blocked bugs
334           $output =~ s{(?<=Blocking bugs)(?:( of )(\d+))?( (?:added|set to|removed):\s+)([\d\s\,]+)}
335                       {(defined $2?$1.bug_links(bug=>$2):'').$3.
336                            english_join([map {bug_links(bug=>$_)} (split /\,?\s+/, $4)])}eo;
337           $output =~ s{((?:[Aa]dded|[Rr]emoved)\ blocking\ bug(?:\(s\))?)(?:(\ of\ )(\d+))?(:?\s+)
338                        (\d+(?:,\s+\d+)*(?:\,?\s+and\s+\d+)?)}
339                       {$1.(defined $3?$2.bug_links(bug=>$3):'').$4.
340                            english_join([map {bug_links(bug=>$_)} (split /\,?\s+(?:and\s+)?/, $5)])}xeo;
341           # Add links to reassigned packages
342           $output =~ s{(Bug reassigned from package \`)([^']+?)((?:'|\&\#39;) to \`)([^']+?)((?:'|\&\#39;))}
343           {$1.q(<a href=").html_escape(pkg_url(pkg=>$2)).qq(">$2</a>).$3.q(<a href=").html_escape(pkg_url(pkg=>$4)).qq(">$4</a>).$5}eo;
344           if (defined $time) {
345                $output .= ' ('.strftime('%a, %d %b %Y %T GMT',gmtime($time)).') ';
346           }
347           $output .= '<a href="' .
348                html_escape(bug_links(bug => $bug_number,
349                                      options => {msg => ($msg_number+1)},
350                                      links_only => 1,
351                                     )
352                           ) . '">Full text</a> and <a href="' .
353                                html_escape(bug_links(bug => $bug_number,
354                                                      options => {msg => ($msg_number+1),
355                                                                  mbox => 'yes'},
356                                                      links_only => 1)
357                                           ) . '">rfc822 format</a> available.';
358
359           $output = qq(<div class="$class"><hr>\n<a name="$msg_number"></a>\n) . $output . "</div>\n";
360      }
361      elsif (/recips/) {
362           my ($msg_id) = $record->{text} =~ /^Message-Id:\s+<(.+)>/im;
363           if (defined $msg_id and exists $$seen_msg_ids{$msg_id}) {
364                return ();
365           }
366           elsif (defined $msg_id) {
367                $$seen_msg_ids{$msg_id} = 1;
368           }
369           $output .= qq(<hr><p class="msgreceived"><a name="$msg_number"></a>\n);
370           $output .= 'View this message in <a href="' . html_escape(bug_links(bug=>$bug_number, links_only => 1, options=>{msg=>$msg_number, mbox=>'yes'})) . '">rfc822 format</a></p>';
371           $output .= handle_email_message($record->{text},
372                                           ref     => $bug_number,
373                                           msg_num => $msg_number,
374                                          );
375      }
376      elsif (/autocheck/) {
377           # Do nothing
378      }
379      elsif (/incoming-recv/) {
380           my ($msg_id) = $record->{text} =~ /^Message-Id:\s+<(.+)>/im;
381           if (defined $msg_id and exists $$seen_msg_ids{$msg_id}) {
382                return ();
383           }
384           elsif (defined $msg_id) {
385                $$seen_msg_ids{$msg_id} = 1;
386           }
387           # Incomming Mail Message
388           my ($received,$hostname) = $record->{text} =~ m/Received: \(at (\S+)\) by (\S+)\;/;
389           $output .= qq|<hr><p class="msgreceived"><a name="$msg_number"></a><a name="msg$msg_number"></a><a href="#$msg_number">Message #$msg_number</a> received at |.
390                html_escape("$received\@$hostname") .
391                     q| (<a href="| . html_escape(bug_links(bug => $bug_number, links_only => 1, options => {msg=>$msg_number})) . '">full text</a>'.
392                          q|, <a href="| . html_escape(bug_links(bug => $bug_number,
393                                                                 links_only => 1,
394                                                                 options => {msg=>$msg_number,
395                                                                             mbox=>'yes'}
396                                                                )
397                                                      ) .'">mbox</a>)'.":</p>\n";
398           $output .= handle_email_message($record->{text},
399                                           ref     => $bug_number,
400                                           msg_num => $msg_number,
401                                          );
402      }
403      else {
404           die "Unknown record type $_";
405      }
406      return $output;
407 }
408
409
410
411 1;
412
413
414 __END__
415
416
417
418
419
420