]> git.donarmstrong.com Git - debbugs.git/blobdiff - Debbugs/CGI/Bugreport.pm
Linkify CVE reports (closes: #568464). Thanks to Martin Zobel-Helas.
[debbugs.git] / Debbugs / CGI / Bugreport.pm
index cb1f48cf261fe35c6242e30e90d149cce199387f..ba4c7a4f30ee3185b9eb5dc377a177bc914b18da 100644 (file)
@@ -34,7 +34,7 @@ use IO::Scalar;
 use Params::Validate qw(validate_with :types);
 use Debbugs::MIME qw(convert_to_utf8 decode_rfc1522 create_mime_message);
 use Debbugs::CGI qw(:url :html :util);
-use Debbugs::Common qw(globify_scalar);
+use Debbugs::Common qw(globify_scalar english_join);
 use POSIX qw(strftime);
 
 BEGIN{
@@ -43,7 +43,7 @@ BEGIN{
 
      @EXPORT = ();
      %EXPORT_TAGS = ();
-     @EXPORT_OK = (qw(display_entities handle_record handle_email_message));
+     @EXPORT_OK = (qw(display_entity handle_record handle_email_message));
      Exporter::export_ok_tags(keys %EXPORT_TAGS);
      $EXPORT_TAGS{all} = [@EXPORT_OK];
 }
@@ -171,12 +171,16 @@ sub display_entity {
            return;
        }
        elsif (not exists $param{att}) {
-            my @dlargs = ($ref, msg=>$xmessage, att=>$#$attachments);
+            my @dlargs = (msg=>$xmessage, att=>$#$attachments);
             push @dlargs, (filename=>$filename) if $filename ne '';
             my $printname = $filename;
             $printname = 'Message part ' . ($#$attachments + 1) if $filename eq '';
-            print {$param{output}} '<pre class="mime">[<a href="' . html_escape(bug_url(@dlargs)) . qq{">$printname</a> } .
-                 "($type, $disposition)]</pre>\n";
+            print {$param{output}} '<pre class="mime">[<a href="' .
+                 html_escape(bug_links(bug => $ref,
+                                       links_only => 1,
+                                       options => {@dlargs})
+                            ) . qq{">$printname</a> } .
+                                 "($type, $disposition)]</pre>\n";
        }
     }
 
@@ -212,7 +216,7 @@ sub display_entity {
                           bug_num => $ref,
                           outer => 1,
                           msg_num => $xmessage,
-                          ouput => $param{output},
+                          output => $param{output},
                           attachments => $attachments,
                           terse => $param{terse},
                           exists $param{msg}?(msg=>$param{msg}):(),
@@ -245,12 +249,15 @@ sub display_entity {
         $body =~ s[(closes:\s*(?:bug)?\#?\s?\d+(?:,?\s*(?:bug)?\#?\s?\d+)*)]
                   [my $temp = $1;
                    $temp =~ s{(\d+)}
-                             {qq(<a href=").
-                                   html_escape(bug_url($1)).
-                                        qq(">$1</a>)
-                                   }ge;
+                             {bug_links(bug=>$1)}ge;
                    $temp;]gxie;
-
+        if (defined $config{cve_tracker} and
+            length $config{cve_tracker}
+           ) {
+            # Add links to CVE vulnerabilities (closes #568464)
+            $body =~ s{(CVE-\d{4}-\d{4,})}
+                      {<a href="http://$config{cve_tracker}$1">$1</a>}gx;
+        }
         if (not exists $param{att}) {
              print {$param{output}} qq(<pre class="message">$body</pre>\n);
         }
@@ -291,6 +298,7 @@ sub handle_email_message{
                    terse       => $param{terse},
                    exists $param{msg}?(msg=>$param{msg}):(),
                    exists $param{att}?(att=>$param{att}):(),
+                   exists $param{trim_headers}?(trim_headers=>$param{trim_headers}):(),
                   );
      return $output;
 
@@ -313,27 +321,40 @@ sub handle_record{
      local $_ = $record->{type};
      if (/html/) {
          my ($time) = $record->{text} =~ /<!--\s+time:(\d+)\s+-->/;
-         my $class = $record->{text} =~ /^<strong>(?:Acknowledgement|Reply|Information|Report|Notification)/ ? 'infmessage':'msgreceived';
+         my $class = $record->{text} =~ /^<strong>(?:Acknowledgement|Reply|Information|Report|Notification)/m ? 'infmessage':'msgreceived';
          $output .= decode_rfc1522($record->{text});
          # Link to forwarded http:// urls in the midst of the report
          # (even though these links already exist at the top)
-         $output =~ s,((?:ftp|http|https)://[\S~-]+?/?)([\)\'\:\.\,]?(?:\s|\.<|$)),<a href=\"$1\">$1</a>$2,go;
+         $output =~ s,((?:ftp|http|https)://[\S~-]+?/?)((?:[\)\'\:\.\,]|\&\#39;)?(?:\s|\.<|$)),<a href=\"$1\">$1</a>$2,go;
          # Add links to the cloned bugs
-         $output =~ s{(Bug )(\d+)( cloned as bugs? )(\d+)(?:\-(\d+)|)}{$1.bug_links(bug=>$2).$3.bug_links(bug=>[$4..$5])}eo;
+         $output =~ s{(Bug )(\d+)( cloned as bugs? )(\d+)(?:\-(\d+)|)}{$1.bug_links(bug=>$2).$3.bug_links(bug=>(defined $5)?[$4..$5]:$4)}eo;
          # Add links to merged bugs
          $output =~ s{(?<=Merged )([\d\s]+)(?=\.)}{join(' ',map {bug_links(bug=>$_)} (split /\s+/, $1))}eo;
          # Add links to blocked bugs
          $output =~ s{(?<=Blocking bugs)(?:( of )(\d+))?( (?:added|set to|removed):\s+)([\d\s\,]+)}
                      {(defined $2?$1.bug_links(bug=>$2):'').$3.
-                           join(' ',map {bug_links(bug=>$_)} (split /\,?\s+/, $4))}eo;
+                          english_join([map {bug_links(bug=>$_)} (split /\,?\s+/, $4)])}eo;
+         $output =~ s{((?:[Aa]dded|[Rr]emoved)\ blocking\ bug(?:\(s\))?)(?:(\ of\ )(\d+))?(:?\s+)
+                      (\d+(?:,\s+\d+)*(?:\,?\s+and\s+\d+)?)}
+                     {$1.(defined $3?$2.bug_links(bug=>$3):'').$4.
+                          english_join([map {bug_links(bug=>$_)} (split /\,?\s+(?:and\s+)?/, $5)])}xeo;
          # Add links to reassigned packages
          $output =~ s{(Bug reassigned from package \`)([^']+?)((?:'|\&\#39;) to \`)([^']+?)((?:'|\&\#39;))}
          {$1.q(<a href=").html_escape(pkg_url(pkg=>$2)).qq(">$2</a>).$3.q(<a href=").html_escape(pkg_url(pkg=>$4)).qq(">$4</a>).$5}eo;
          if (defined $time) {
               $output .= ' ('.strftime('%a, %d %b %Y %T GMT',gmtime($time)).') ';
          }
-         $output .= '<a href="' . html_escape(bug_url($bug_number, msg => ($msg_number+1))) . '">Full text</a> and <a href="' .
-              html_escape(bug_url($bug_number, msg => ($msg_number+1), mbox => 'yes')) . '">rfc822 format</a> available.';
+         $output .= '<a href="' .
+              html_escape(bug_links(bug => $bug_number,
+                                    options => {msg => ($msg_number+1)},
+                                    links_only => 1,
+                                   )
+                         ) . '">Full text</a> and <a href="' .
+                              html_escape(bug_links(bug => $bug_number,
+                                                    options => {msg => ($msg_number+1),
+                                                                mbox => 'yes'},
+                                                    links_only => 1)
+                                         ) . '">rfc822 format</a> available.';
 
          $output = qq(<div class="$class"><hr>\n<a name="$msg_number"></a>\n) . $output . "</div>\n";
      }
@@ -346,7 +367,7 @@ sub handle_record{
               $$seen_msg_ids{$msg_id} = 1;
          }
          $output .= qq(<hr><p class="msgreceived"><a name="$msg_number"></a>\n);
-         $output .= 'View this message in <a href="' . html_escape(bug_url($bug_number, msg=>$msg_number, mbox=>'yes')) . '">rfc822 format</a></p>';
+         $output .= 'View this message in <a href="' . html_escape(bug_links(bug=>$bug_number, links_only => 1, options=>{msg=>$msg_number, mbox=>'yes'})) . '">rfc822 format</a></p>';
          $output .= handle_email_message($record->{text},
                                          ref     => $bug_number,
                                          msg_num => $msg_number,
@@ -367,8 +388,13 @@ sub handle_record{
          my ($received,$hostname) = $record->{text} =~ m/Received: \(at (\S+)\) by (\S+)\;/;
          $output .= qq|<hr><p class="msgreceived"><a name="$msg_number"></a><a name="msg$msg_number"></a><a href="#$msg_number">Message #$msg_number</a> received at |.
               html_escape("$received\@$hostname") .
-                   q| (<a href="| . html_escape(bug_url($bug_number, msg=>$msg_number)) . '">full text</a>'.
-                        q|, <a href="| . html_escape(bug_url($bug_number, msg=>$msg_number,mbox=>'yes')) .'">mbox</a>)'.":</p>\n";
+                   q| (<a href="| . html_escape(bug_links(bug => $bug_number, links_only => 1, options => {msg=>$msg_number})) . '">full text</a>'.
+                        q|, <a href="| . html_escape(bug_links(bug => $bug_number,
+                                                               links_only => 1,
+                                                               options => {msg=>$msg_number,
+                                                                           mbox=>'yes'}
+                                                              )
+                                                    ) .'">mbox</a>)'.":</p>\n";
          $output .= handle_email_message($record->{text},
                                          ref     => $bug_number,
                                          msg_num => $msg_number,