unofficial mirror of meta@public-inbox.org
 help / color / mirror / Atom feed
From: Eric Wong <e@80x24.org>
To: meta@public-inbox.org
Subject: [PATCH 2/3] view: fix addr2urlmap with Plack::Builder::mount
Date: Fri, 13 Sep 2024 22:07:23 +0000	[thread overview]
Message-ID: <20240913220724.2958606-3-e@80x24.org> (raw)
In-Reply-To: <20240913220724.2958606-1-e@80x24.org>

Plack::App::URLMap does not preserve SCRIPT_NAME set for PSGI
`mount' directives when running response callbacks.  Thus we
must get $ibx->base_url($ctx->{env}) calls to generate correct
full URLs when relying on publicinbox.nameIsUrl up front before
the PSGI response callback is returned.
---
 lib/PublicInbox/Feed.pm       |  3 ++
 lib/PublicInbox/SearchView.pm |  1 +
 lib/PublicInbox/View.pm       | 61 ++++++++++++++++++-----------------
 3 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/lib/PublicInbox/Feed.pm b/lib/PublicInbox/Feed.pm
index a1c1d4d6..b6e4267f 100644
--- a/lib/PublicInbox/Feed.pm
+++ b/lib/PublicInbox/Feed.pm
@@ -19,6 +19,7 @@ sub generate {
 	my ($ctx) = @_;
 	my $msgs = $ctx->{msgs} = recent_msgs($ctx);
 	return _no_thread() unless @$msgs;
+	PublicInbox::View::addr2urlmap $ctx;
 	PublicInbox::WwwAtomStream->response($ctx, \&generate_i);
 }
 
@@ -26,6 +27,7 @@ sub generate_thread_atom {
 	my ($ctx) = @_;
 	my $msgs = $ctx->{msgs} = $ctx->{ibx}->over->get_thread($ctx->{mid});
 	return _no_thread() unless @$msgs;
+	PublicInbox::View::addr2urlmap $ctx;
 	PublicInbox::WwwAtomStream->response($ctx, \&generate_i);
 }
 
@@ -69,6 +71,7 @@ sub new_html {
 	$ctx->{-upfx} = '';
 	$ctx->{-spfx} = '' if $ctx->{ibx}->{coderepo};
 	$ctx->{-hr} = 1;
+	PublicInbox::View::addr2urlmap $ctx;
 	PublicInbox::WwwStream::aresponse($ctx, \&new_html_i);
 }
 
diff --git a/lib/PublicInbox/SearchView.pm b/lib/PublicInbox/SearchView.pm
index 3729c27b..1213b3d3 100644
--- a/lib/PublicInbox/SearchView.pm
+++ b/lib/PublicInbox/SearchView.pm
@@ -33,6 +33,7 @@ sub sres_top_html {
 	my $srch = $ctx->{srch} = $ctx->{ibx}->isrch or
 		return PublicInbox::WWW::need($ctx, 'Search');
 	my $q = PublicInbox::SearchQuery->new($ctx->{qp});
+	PublicInbox::View::addr2urlmap $ctx if $q->{x} eq 't';
 	my $o = $q->{o} // 0;
 	my $asc;
 	if ($o < 0) {
diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm
index 19f4168e..75387dce 100644
--- a/lib/PublicInbox/View.pm
+++ b/lib/PublicInbox/View.pm
@@ -64,10 +64,39 @@ sub no_over_html ($) {
 	$ctx->html_done;
 }
 
+sub addr2urlmap ($) {
+	my ($ctx) = @_;
+	# cache makes a huge difference with /[tT] and large threads
+	my $key = PublicInbox::Git::host_prefix_url($ctx->{env}, '');
+	my $ent = $ctx->{www}->{pi_cfg}->{-addr2urlmap}->{$key} // do {
+		my $by_addr = $ctx->{www}->{pi_cfg}->{-by_addr};
+		my (%addr2url, $url);
+		while (my ($addr, $ibx) = each %$by_addr) {
+			$url = $ibx->base_url // $ibx->base_url($ctx->{env});
+			$addr2url{ascii_html($addr)} = ascii_html($url) if
+				defined $url
+		}
+		# don't allow attackers to randomly change Host: headers
+		# and OOM us if the server handles all hostnames:
+		my $tmp = $ctx->{www}->{pi_cfg}->{-addr2urlmap};
+		my @k = keys %$tmp; # random order
+		delete @$tmp{@k[0..3]} if scalar(@k) > 7;
+		if (scalar keys %addr2url) {
+			my $re = join('|', map { quotemeta } keys %addr2url);
+			$tmp->{$key} = [ qr/\b($re)\b/i, \%addr2url ];
+		} else { # nothing? NUL should never match:
+			[ qr/(\0)/, { "\0" => './' } ];
+		}
+	};
+	$ctx->{-addr2urlmap} = $ent;
+}
+
 # public functions: (unstable)
 
+# GET /$INBOX/$MSGID/ (single message page)
 sub msg_page {
 	my ($ctx) = @_;
+	addr2urlmap $ctx;
 	my $ibx = $ctx->{ibx};
 	$ctx->{-obfs_ibx} = $ibx->{obfuscate} ? $ibx : undef;
 	my $over = $ibx->over or return no_over_html($ctx);
@@ -187,38 +216,10 @@ sub nr_to_s ($$$) {
 	$nr == 1 ? "$nr $singular" : "$nr $plural";
 }
 
-sub addr2urlmap ($) {
-	my ($ctx) = @_;
-	# cache makes a huge difference with /[tT] and large threads
-	my $key = PublicInbox::Git::host_prefix_url($ctx->{env}, '');
-	my $ent = $ctx->{www}->{pi_cfg}->{-addr2urlmap}->{$key} // do {
-		my $by_addr = $ctx->{www}->{pi_cfg}->{-by_addr};
-		my (%addr2url, $url);
-		while (my ($addr, $ibx) = each %$by_addr) {
-			$url = $ibx->base_url // $ibx->base_url($ctx->{env});
-			$addr2url{ascii_html($addr)} = ascii_html($url) if
-				defined $url;
-		}
-		# don't allow attackers to randomly change Host: headers
-		# and OOM us if the server handles all hostnames:
-		my $tmp = $ctx->{www}->{pi_cfg}->{-addr2urlmap};
-		my @k = keys %$tmp; # random order
-		delete @$tmp{@k[0..3]} if scalar(@k) > 7;
-		if (scalar keys %addr2url) {
-			my $re = join('|', map { quotemeta } keys %addr2url);
-			$tmp->{$key} = [ qr/\b($re)\b/i, \%addr2url ];
-		} else { # nothing? NUL should never match:
-			[ qr/(\0)/, { "\0" => './' } ];
-		}
-	};
-	@$ent;
-}
-
 # called by /$INBOX/$MSGID/[tT]/
 sub to_cc_html ($$$$) {
 	my ($ctx, $eml, $field, $t) = @_;
 	my @vals = $eml->header($field) or return ('', 0);
-	my (undef, $addr2url) = addr2urlmap($ctx);
 	my $pairs = PublicInbox::Address::pairs(join(', ', @vals));
 	my ($len, $line_len, $html) = (0, 0, '');
 	my ($pair, $url);
@@ -227,6 +228,7 @@ sub to_cc_html ($$$$) {
 	my @html = split /\n/, ascii_html(join("\n", map {
 		$_->[0] // (split(/\@/, $_->[1]))[0]; # addr user if no name
 	} @$pairs));
+	my (undef, $addr2url) = @{$ctx->{-addr2urlmap}};
 	for my $n (@html) {
 		$pair = shift @$pairs;
 		if ($line_len) { # 9 = display width of ",\t":
@@ -552,6 +554,7 @@ EOM
 	walk_thread($rootset, $ctx, \&pre_thread); # pushes to ctx->{skel}
 
 	push @{$ctx->{skel}}, '</pre>';
+	addr2urlmap $ctx;
 	return stream_thread($rootset, $ctx) unless $ctx->{flat};
 
 	# flat display: lazy load the full message from smsg
@@ -724,7 +727,7 @@ href="d/">diff</a>)</pre><pre>];
 	$hbuf .= "Date: $_\n" for $eml->header('Date');
 	$hbuf = ascii_html($hbuf);
 	my $t = $ts ? '?t='.ts2str($ts) : '';
-	my ($re, $addr2url) = addr2urlmap($ctx);
+	my ($re, $addr2url) = @{$ctx->{-addr2urlmap}};
 	# $url is relative to /$INBOX/$MSGID/
 	$hbuf =~ s#$re#
 		my ($addr, $url) = ($1, $addr2url->{lc $1});

  parent reply	other threads:[~2024-09-13 22:07 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-09-13 22:07 [PATCH 0/3] www: addr2urlmap fixes Eric Wong
2024-09-13 22:07 ` [PATCH 1/3] view: addr2urlmap matches HTML-escaped addresses, only Eric Wong
2024-09-13 22:07 ` Eric Wong [this message]
2024-09-13 22:07 ` [PATCH 3/3] view: disable address URL-fication of possible HTML escapes Eric Wong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://public-inbox.org/README

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240913220724.2958606-3-e@80x24.org \
    --to=e@80x24.org \
    --cc=meta@public-inbox.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).