1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-10 00:42:41 +01:00

Restore image proxying to Remarkup

Summary:
Previously, Remarkup allowed you to paste in an image URI and get an inline
image. However, it did this by hotlinking the image which isn't so hot in an
open source product.

Restore this feature, but use image proxying instead. The existing image macro
code does most of the work.

There is a mild security risk depending on the network setup so I've left this
default-disabled and made a note about it. It should be safe to enable for
Facebook.

Test Plan:
Pasted in image and non-image links, got reasonable behavior. Verified proxying
appears to work. Verified that file:// shenanigans produce 400.

Reviewed By: tuomaspelkonen
Reviewers: aran, jungejason, tuomaspelkonen
Commenters: cpiro
CC: aran, cpiro, tuomaspelkonen
Differential Revision: 214
This commit is contained in:
epriestley 2011-05-02 14:20:24 -07:00
parent b75960c578
commit 03ebbccbc9
15 changed files with 259 additions and 17 deletions

View file

@ -292,6 +292,16 @@ return array(
'text/plain' => 'text/plain; charset=utf-8', 'text/plain' => 'text/plain; charset=utf-8',
), ),
// Phabricator can proxy images from other servers so you can paste the URI
// to a funny picture of a cat into the comment box and have it show up as an
// image. However, this means the webserver Phabricator is running on will
// make HTTP requests to arbitrary URIs. If the server has access to internal
// resources, this could be a security risk. You should only enable it if you
// are installed entirely a VPN and VPN access is required to access
// Phabricator, or if the webserver has no special access to anything. If
// unsure, it is safer to leave this disabled.
'files.enable-proxy' => false,
// -- Differential ---------------------------------------------------------- // // -- Differential ---------------------------------------------------------- //
'differential.revision-custom-detail-renderer' => null, 'differential.revision-custom-detail-renderer' => null,

View file

@ -0,0 +1,6 @@
CREATE TABLE phabricator_file.file_proxyimage (
id int unsigned not null primary key auto_increment,
uri varchar(255) binary not null,
unique key(uri),
filePHID varchar(64) binary not null
) ENGINE=InnoDB;

View file

@ -616,7 +616,7 @@ celerity_register_resource_map(array(
), ),
'phabricator-remarkup-css' => 'phabricator-remarkup-css' =>
array( array(
'uri' => '/res/1fc75ba6/rsrc/css/core/remarkup.css', 'uri' => '/res/41748e59/rsrc/css/core/remarkup.css',
'type' => 'css', 'type' => 'css',
'requires' => 'requires' =>
array( array(
@ -653,7 +653,7 @@ celerity_register_resource_map(array(
), array ( ), array (
'packages' => 'packages' =>
array ( array (
'14e8c91d' => '4270730a' =>
array ( array (
'name' => 'core.pkg.css', 'name' => 'core.pkg.css',
'symbols' => 'symbols' =>
@ -673,7 +673,7 @@ celerity_register_resource_map(array(
12 => 'phabricator-remarkup-css', 12 => 'phabricator-remarkup-css',
13 => 'syntax-highlighting-css', 13 => 'syntax-highlighting-css',
), ),
'uri' => '/res/pkg/14e8c91d/core.pkg.css', 'uri' => '/res/pkg/4270730a/core.pkg.css',
'type' => 'css', 'type' => 'css',
), ),
'6c786373' => '6c786373' =>
@ -720,14 +720,14 @@ celerity_register_resource_map(array(
), ),
'reverse' => 'reverse' =>
array ( array (
'aphront-crumbs-view-css' => '14e8c91d', 'aphront-crumbs-view-css' => '4270730a',
'aphront-dialog-view-css' => '14e8c91d', 'aphront-dialog-view-css' => '4270730a',
'aphront-form-view-css' => '14e8c91d', 'aphront-form-view-css' => '4270730a',
'aphront-panel-view-css' => '14e8c91d', 'aphront-panel-view-css' => '4270730a',
'aphront-side-nav-view-css' => '14e8c91d', 'aphront-side-nav-view-css' => '4270730a',
'aphront-table-view-css' => '14e8c91d', 'aphront-table-view-css' => '4270730a',
'aphront-tokenizer-control-css' => '14e8c91d', 'aphront-tokenizer-control-css' => '4270730a',
'aphront-typeahead-control-css' => '14e8c91d', 'aphront-typeahead-control-css' => '4270730a',
'differential-changeset-view-css' => '8d8a971a', 'differential-changeset-view-css' => '8d8a971a',
'differential-core-view-css' => '8d8a971a', 'differential-core-view-css' => '8d8a971a',
'differential-revision-add-comment-css' => '8d8a971a', 'differential-revision-add-comment-css' => '8d8a971a',
@ -742,11 +742,11 @@ celerity_register_resource_map(array(
'javelin-behavior-differential-feedback-preview' => '6c786373', 'javelin-behavior-differential-feedback-preview' => '6c786373',
'javelin-behavior-differential-populate' => '6c786373', 'javelin-behavior-differential-populate' => '6c786373',
'javelin-behavior-differential-show-more' => '6c786373', 'javelin-behavior-differential-show-more' => '6c786373',
'phabricator-core-buttons-css' => '14e8c91d', 'phabricator-core-buttons-css' => '4270730a',
'phabricator-core-css' => '14e8c91d', 'phabricator-core-css' => '4270730a',
'phabricator-directory-css' => '14e8c91d', 'phabricator-directory-css' => '4270730a',
'phabricator-remarkup-css' => '14e8c91d', 'phabricator-remarkup-css' => '4270730a',
'phabricator-standard-page-view' => '14e8c91d', 'phabricator-standard-page-view' => '4270730a',
'syntax-highlighting-css' => '14e8c91d', 'syntax-highlighting-css' => '4270730a',
), ),
)); ));

View file

@ -310,6 +310,8 @@ phutil_register_library_map(array(
'PhabricatorFileMacroDeleteController' => 'applications/files/controller/macrodelete', 'PhabricatorFileMacroDeleteController' => 'applications/files/controller/macrodelete',
'PhabricatorFileMacroEditController' => 'applications/files/controller/macroedit', 'PhabricatorFileMacroEditController' => 'applications/files/controller/macroedit',
'PhabricatorFileMacroListController' => 'applications/files/controller/macrolist', 'PhabricatorFileMacroListController' => 'applications/files/controller/macrolist',
'PhabricatorFileProxyController' => 'applications/files/controller/proxy',
'PhabricatorFileProxyImage' => 'applications/files/storage/proxyimage',
'PhabricatorFileStorageBlob' => 'applications/files/storage/storageblob', 'PhabricatorFileStorageBlob' => 'applications/files/storage/storageblob',
'PhabricatorFileURI' => 'applications/files/uri', 'PhabricatorFileURI' => 'applications/files/uri',
'PhabricatorFileUploadController' => 'applications/files/controller/upload', 'PhabricatorFileUploadController' => 'applications/files/controller/upload',
@ -382,6 +384,7 @@ phutil_register_library_map(array(
'PhabricatorRemarkupRuleDiffusion' => 'infrastructure/markup/remarkup/markuprule/diffusion', 'PhabricatorRemarkupRuleDiffusion' => 'infrastructure/markup/remarkup/markuprule/diffusion',
'PhabricatorRemarkupRuleImageMacro' => 'infrastructure/markup/remarkup/markuprule/imagemacro', 'PhabricatorRemarkupRuleImageMacro' => 'infrastructure/markup/remarkup/markuprule/imagemacro',
'PhabricatorRemarkupRuleManiphest' => 'infrastructure/markup/remarkup/markuprule/maniphest', 'PhabricatorRemarkupRuleManiphest' => 'infrastructure/markup/remarkup/markuprule/maniphest',
'PhabricatorRemarkupRuleProxyImage' => 'infrastructure/markup/remarkup/markuprule/proxyimage',
'PhabricatorRepository' => 'applications/repository/storage/repository', 'PhabricatorRepository' => 'applications/repository/storage/repository',
'PhabricatorRepositoryArcanistProject' => 'applications/repository/storage/arcanistproject', 'PhabricatorRepositoryArcanistProject' => 'applications/repository/storage/arcanistproject',
'PhabricatorRepositoryArcanistProjectEditController' => 'applications/repository/controller/arcansistprojectedit', 'PhabricatorRepositoryArcanistProjectEditController' => 'applications/repository/controller/arcansistprojectedit',
@ -718,6 +721,8 @@ phutil_register_library_map(array(
'PhabricatorFileMacroDeleteController' => 'PhabricatorFileController', 'PhabricatorFileMacroDeleteController' => 'PhabricatorFileController',
'PhabricatorFileMacroEditController' => 'PhabricatorFileController', 'PhabricatorFileMacroEditController' => 'PhabricatorFileController',
'PhabricatorFileMacroListController' => 'PhabricatorFileController', 'PhabricatorFileMacroListController' => 'PhabricatorFileController',
'PhabricatorFileProxyController' => 'PhabricatorFileController',
'PhabricatorFileProxyImage' => 'PhabricatorFileDAO',
'PhabricatorFileStorageBlob' => 'PhabricatorFileDAO', 'PhabricatorFileStorageBlob' => 'PhabricatorFileDAO',
'PhabricatorFileUploadController' => 'PhabricatorFileController', 'PhabricatorFileUploadController' => 'PhabricatorFileController',
'PhabricatorFileViewController' => 'PhabricatorFileController', 'PhabricatorFileViewController' => 'PhabricatorFileController',
@ -782,6 +787,7 @@ phutil_register_library_map(array(
'PhabricatorRemarkupRuleDiffusion' => 'PhutilRemarkupRule', 'PhabricatorRemarkupRuleDiffusion' => 'PhutilRemarkupRule',
'PhabricatorRemarkupRuleImageMacro' => 'PhutilRemarkupRule', 'PhabricatorRemarkupRuleImageMacro' => 'PhutilRemarkupRule',
'PhabricatorRemarkupRuleManiphest' => 'PhutilRemarkupRule', 'PhabricatorRemarkupRuleManiphest' => 'PhutilRemarkupRule',
'PhabricatorRemarkupRuleProxyImage' => 'PhutilRemarkupRule',
'PhabricatorRepository' => 'PhabricatorRepositoryDAO', 'PhabricatorRepository' => 'PhabricatorRepositoryDAO',
'PhabricatorRepositoryArcanistProject' => 'PhabricatorRepositoryDAO', 'PhabricatorRepositoryArcanistProject' => 'PhabricatorRepositoryDAO',
'PhabricatorRepositoryArcanistProjectEditController' => 'PhabricatorRepositoryController', 'PhabricatorRepositoryArcanistProjectEditController' => 'PhabricatorRepositoryController',

View file

@ -60,6 +60,7 @@ class AphrontDefaultApplicationConfiguration
'edit/(?:(?P<id>\d+)/)?$' => 'PhabricatorFileMacroEditController', 'edit/(?:(?P<id>\d+)/)?$' => 'PhabricatorFileMacroEditController',
'delete/(?P<id>\d+)/$' => 'PhabricatorFileMacroDeleteController', 'delete/(?P<id>\d+)/$' => 'PhabricatorFileMacroDeleteController',
), ),
'proxy/$' => 'PhabricatorFileProxyController',
), ),
'/phid/' => array( '/phid/' => array(
'$' => 'PhabricatorPHIDLookupController', '$' => 'PhabricatorPHIDLookupController',

View file

@ -28,6 +28,9 @@ class DifferentialMarkupEngineFactory {
$rules = array(); $rules = array();
$rules[] = new PhutilRemarkupRuleEscapeRemarkup(); $rules[] = new PhutilRemarkupRuleEscapeRemarkup();
if (PhabricatorEnv::getEnvConfig('files.enable-proxy')) {
$rules[] = new PhabricatorRemarkupRuleProxyImage();
}
$rules[] = new PhutilRemarkupRuleHyperlink(); $rules[] = new PhutilRemarkupRuleHyperlink();
$rules[] = new PhabricatorRemarkupRuleDifferential(); $rules[] = new PhabricatorRemarkupRuleDifferential();

View file

@ -11,6 +11,7 @@ phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/
phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/diffusion'); phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/diffusion');
phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/imagemacro'); phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/imagemacro');
phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/maniphest'); phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/maniphest');
phutil_require_module('phabricator', 'infrastructure/markup/remarkup/markuprule/proxyimage');
phutil_require_module('phutil', 'markup/engine/remarkup'); phutil_require_module('phutil', 'markup/engine/remarkup');
phutil_require_module('phutil', 'markup/engine/remarkup/blockrule/remarkupcode'); phutil_require_module('phutil', 'markup/engine/remarkup/blockrule/remarkupcode');

View file

@ -0,0 +1,55 @@
<?php
/*
* Copyright 2011 Facebook, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
class PhabricatorFileProxyController extends PhabricatorFileController {
private $uri;
public function processRequest() {
if (!PhabricatorEnv::getEnvConfig('files.enable-proxy')) {
return new Aphront400Response();
}
$request = $this->getRequest();
$uri = $request->getStr('uri');
$proxy = id(new PhabricatorFileProxyImage())->loadOneWhere(
'uri = %s',
$uri);
if (!$proxy) {
$file = PhabricatorFile::newFromFileDownload(
$uri,
nonempty(basename($uri), 'proxied-file'));
if ($file) {
$proxy = new PhabricatorFileProxyImage();
$proxy->setURI($uri);
$proxy->setFilePHID($file->getPHID());
$proxy->save();
}
}
if ($proxy) {
$view_uri = PhabricatorFileURI::getViewURIForPHID($proxy->getFilePHID());
return id(new AphrontRedirectResponse())->setURI($view_uri);
}
return new Aphront400Response();
}
}

View file

@ -0,0 +1,20 @@
<?php
/**
* This file is automatically generated. Lint this module to rebuild it.
* @generated
*/
phutil_require_module('phabricator', 'aphront/response/400');
phutil_require_module('phabricator', 'aphront/response/redirect');
phutil_require_module('phabricator', 'applications/files/controller/base');
phutil_require_module('phabricator', 'applications/files/storage/file');
phutil_require_module('phabricator', 'applications/files/storage/proxyimage');
phutil_require_module('phabricator', 'applications/files/uri');
phutil_require_module('phabricator', 'infrastructure/env');
phutil_require_module('phutil', 'utils');
phutil_require_source('PhabricatorFileProxyController.php');

View file

@ -123,6 +123,17 @@ class PhabricatorFile extends PhabricatorFileDAO {
public static function newFromFileDownload($uri, $name) { public static function newFromFileDownload($uri, $name) {
$uri = new PhutilURI($uri); $uri = new PhutilURI($uri);
$protocol = $uri->getProtocol();
switch ($protocol) {
case 'http':
case 'https':
break;
default:
// Make sure we are not accessing any file:// URIs or similar.
return null;
}
$timeout = stream_context_create( $timeout = stream_context_create(
array( array(
'http' => array( 'http' => array(

View file

@ -0,0 +1,34 @@
<?php
/*
* Copyright 2011 Facebook, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
class PhabricatorFileProxyImage extends PhabricatorFileDAO {
protected $uri;
protected $filePHID;
public function getConfiguration() {
return array(
self::CONFIG_TIMESTAMPS => false,
) + parent::getConfiguration();
}
static public function getProxyImageURI($uri) {
return '/file/proxy/?uri='.phutil_escape_uri($uri);
}
}

View file

@ -0,0 +1,14 @@
<?php
/**
* This file is automatically generated. Lint this module to rebuild it.
* @generated
*/
phutil_require_module('phabricator', 'applications/files/storage/base');
phutil_require_module('phutil', 'markup');
phutil_require_source('PhabricatorFileProxyImage.php');

View file

@ -0,0 +1,61 @@
<?php
/*
* Copyright 2011 Facebook, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/**
* @group markup
*/
class PhabricatorRemarkupRuleProxyImage
extends PhutilRemarkupRule {
public function apply($text) {
$filetypes = '(?:\.jpe?g|.png|.gif)';
$text = preg_replace_callback(
'@[<](\w{3,}://.+?'.$filetypes.')[>]@',
array($this, 'markupProxyImage'),
$text);
$text = preg_replace_callback(
'@(?<=^|\s)(\w{3,}://\S+'.$filetypes.')(?=\s|$)@',
array($this, 'markupProxyImage'),
$text);
return $text;
}
public function markupProxyImage($matches) {
$uri = PhabricatorFileProxyImage::getProxyImageURI($matches[1]);
return $this->getEngine()->storeText(
phutil_render_tag(
'a',
array(
'href' => $uri,
'target' => '_blank',
),
phutil_render_tag(
'img',
array(
'src' => $uri,
'class' => 'remarkup-proxy-image',
))));
}
}

View file

@ -0,0 +1,15 @@
<?php
/**
* This file is automatically generated. Lint this module to rebuild it.
* @generated
*/
phutil_require_module('phabricator', 'applications/files/storage/proxyimage');
phutil_require_module('phutil', 'markup');
phutil_require_module('phutil', 'markup/engine/remarkup/markuprule/base');
phutil_require_source('PhabricatorRemarkupRuleProxyImage.php');

View file

@ -48,3 +48,8 @@
margin: .5em 0em; margin: .5em 0em;
padding: .25em 1em; padding: .25em 1em;
} }
.phabricator-remarkup img.remarkup-proxy-image {
max-width: 640px;
max-height: 640px;
}