Skip to content

Output cleanups #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
NickSdot wants to merge 2 commits into
base: master
Choose a base branch
from
+70 −48
Draft

Output cleanups #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
387cc40
Canonicalise feed base URL handling
NickSdot Jul 19, 2026
4227758
Apply additional output hardening
NickSdot Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 14 additions & 12 deletions article.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,14 +60,17 @@
}

head("{$group}: " . format_title($mail['headers']['subject'], 'utf-8'));
$cleanGroupUrl = urlencode($group);
$cleanGroup = clean($group);

echo '<nav class="secondary-nav">';
echo ' <ul class="breadcrumbs">';
echo ' <li class="breadcrumbs-item"><a class="breadcrumbs-item-link" href="/">PHP Mailing Lists</a></li>';
echo ' <li class="breadcrumbs-item"><a class="breadcrumbs-item-link" href="/' .
htmlspecialchars($group, ENT_QUOTES, "UTF-8") . '">' .
htmlspecialchars($group, ENT_QUOTES, "UTF-8") . '</a></li>';
$cleanGroupUrl . '">' .
$cleanGroup . '</a></li>';
echo ' <li class="breadcrumbs-item"><a class="breadcrumbs-item-link" href="/' .
htmlspecialchars($group, ENT_QUOTES, "UTF-8") . '/' . $article . '">' .
$cleanGroupUrl . '/' . $article . '">' .
format_title($mail['headers']['subject'], 'utf-8') . '</a></li>';
echo ' </ul>';
echo '</nav>';
Expand Down Expand Up @@ -107,7 +110,7 @@
echo ' <td class="headervalue" ' . (empty($refsResolved) ? 'colspan="3"' : null) . '>';
$r = explode(",", rtrim($mail['headers']['newsgroups']));
foreach ($r as $v) {
echo "<a href=\"/" . urlencode($v) . "\">" . htmlspecialchars($v) . "</a>&nbsp;";
echo "<a href=\"/" . urlencode($v) . "\">" . clean($v) . "</a>&nbsp;";
}
echo "</td>\n";
}
Expand Down Expand Up @@ -331,7 +334,7 @@
$name = $attachment['filename'];

if ($mimetype == 'text/plain') {
echo htmlspecialchars($attachment['data']);
echo clean($attachment['data']);
continue;
}

Expand All @@ -347,14 +350,14 @@
$link_desc .= " " . $description;
}

$dl_link = "/getpart.php?group=$group&amp;article=$article&amp;part=$mimecount";
$link_desc = htmlspecialchars($link_desc, ENT_QUOTES, 'UTF-8');
$dl_link = "/getpart.php?group=" . urlencode($group) . "&amp;article=" . urlencode((string) $article) . "&amp;part=" . urlencode((string) $mimecount);
$link_desc = clean($link_desc);

/* Attachment filename and mimetype might contain malicious characters */
printf(
'Attachment: <a href="%s">%s</a><br />' . "\n",
$dl_link,
htmlspecialchars($link_desc)
$link_desc,
);
}
}
Expand All @@ -380,23 +383,22 @@

// Does not check existence of next, so consider this the super duper fast [broken] version
// Based off navbar() in group.php
$group = htmlspecialchars($group, ENT_QUOTES, "UTF-8");
$current = $article;

echo ' <table class="standard">' . "\n";
echo ' <tr>' . "\n";
echo ' <th class="nav">';

if ($current > 1) {
echo ' <a href="/' , $group , '/' , ($current - 1) , '"><b>&laquo; <span>previous</span></b></a>';
echo ' <a href="/' , $cleanGroupUrl , '/' , ($current - 1) , '"><b>&laquo; <span>previous</span></b></a>';
} else {
echo '&nbsp;';
}

echo ' </th>' . "\n";
echo ' <th class="align-center">' . "$group (#$current)</th>\n";
echo ' <th class="align-center">' . $cleanGroup . " (#$current)</th>\n";
echo ' <th class="nav align-right">';
echo ' <a href="/' , $group , '/' , ($current + 1) , '"><b><span>next</span> &raquo;</b></a>';
echo ' <a href="/' , $cleanGroupUrl , '/' , ($current + 1) , '"><b><span>next</span> &raquo;</b></a>';
echo ' </th>' . "\n";
echo ' </tr>' . "\n";
echo ' </table>' . "\n";
Expand Down
40 changes: 23 additions & 17 deletions group.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,15 +29,19 @@
error($e->getMessage());
}

$host = htmlspecialchars($_SERVER['HTTP_HOST'], ENT_QUOTES, "UTF-8");
$cleanBaseUrl = clean($NEWS_WEB_BASE_URL);
$baseUrlParts = parse_url($NEWS_WEB_BASE_URL);
$cleanBaseHost = clean($baseUrlParts['host'] . (isset($baseUrlParts['port']) ? ':' . $baseUrlParts['port'] : ''));
$cleanGroupUrl = urlencode($group);
$cleanGroupHtml = clean($group);
switch ($format) {
case 'rss':
header("Content-type: text/xml");
echo '<?xml version="1.0" encoding="utf-8"?>' . "\n";?>
<rss version="2.0">
<channel>
<title><?php echo $host; ?>: <?php echo $group?></title>
<link>http://<?php echo $host; ?>/group.php?group=<?php echo $group?></link>
<title><?php echo $cleanBaseHost; ?>: <?php echo $cleanGroupHtml?></title>
<link><?php echo $cleanBaseUrl; ?>/group.php?group=<?php echo $cleanGroupUrl?></link>
<description></description>
<?php
break;
Expand All @@ -49,9 +53,9 @@
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns="http://my.netscape.com/rdf/simple/0.9/">
<channel>
<title><?php echo $host; ?>: <?php echo $group?></title>
<link>http://<?php echo $host; ?>/group.php?group=<?php echo $group?></link>
<description><?php echo $group?> Newsgroup at <?php echo $NNTP_HOST; ?></description>
<title><?php echo $cleanBaseHost; ?>: <?php echo $cleanGroupHtml?></title>
<link><?php echo $cleanBaseUrl; ?>/group.php?group=<?php echo $cleanGroupUrl?></link>
<description><?php echo $cleanGroupHtml?> Newsgroup at <?php echo clean($NNTP_HOST); ?></description>
<language>en-US</language>
</channel>
<?php
Expand All @@ -63,12 +67,12 @@
echo ' <ul class="breadcrumbs">';
echo ' <li class="breadcrumbs-item"><a class="breadcrumbs-item-link" href="/">PHP Mailing Lists</a></li>';
echo ' <li class="breadcrumbs-item"><a class="breadcrumbs-item-link" href="/',
htmlspecialchars($group, ENT_QUOTES, "UTF-8") . '">',
htmlspecialchars($group, ENT_QUOTES, "UTF-8") . '</a></li>';
$cleanGroupUrl . '">',
$cleanGroupHtml . '</a></li>';
echo ' </ul>';
echo '</nav>';
echo '<section class="content">';
echo '<h1>' . htmlspecialchars($group, ENT_QUOTES, "UTF-8") . '</h1>';
echo '<h1>' . $cleanGroupHtml . '</h1>';
if ($i == 0) {
/* Special header of info for the main page for a group */
$groups = $nntpClient->listGroups($group);
Expand All @@ -89,7 +93,7 @@
</p>
<?php
}
$subscription_address = htmlspecialchars(get_subscribe_address($group));
$subscription_address = clean(get_subscribe_address($group));
?>
<form class="subscription-form" method="POST" action="/subscribe.php">
<input type="hidden" name="group" value="<?= clean($group) ?>">
Expand Down Expand Up @@ -146,39 +150,41 @@
foreach ($overview['articles'] as $articleNumber => $details) {
/* $date = date("H:i:s M/d/y", strtotime($odate)); */
$date822 = date("r", strtotime($details['date']));
$cleanArticlePath = "/$cleanGroupUrl/" . urlencode((string) $articleNumber);
$cleanArticleLink = "$cleanBaseUrl$cleanArticlePath";

switch ($format) {
case 'rss':
echo " <item>\n";
echo " <link>http://$host/$group/$articleNumber</link>\n";
echo " <link>$cleanArticleLink</link>\n";
echo " <title>", format_subject($details['subject'], $charset), "</title>\n";
echo " <description>",
htmlspecialchars(format_author($details['author'], $charset), ENT_QUOTES, "UTF-8"),
clean(format_author($details['author'], $charset)),
"</description>\n";
echo " <pubDate>$date822</pubDate>\n";
echo " </item>\n";
break;
case 'rdf':
echo " <item>\n";
echo " <title>", format_subject($details['subject'], $charset), "</title>\n";
echo " <link>http://$host/$group/$articleNumber</link>\n";
echo " <link>$cleanArticleLink</link>\n";
echo " <description>",
htmlspecialchars(format_author($details['author'], $charset), ENT_QUOTES, "UTF-8"),
clean(format_author($details['author'], $charset)),
"</description>\n";
echo " <pubDate>$date822</pubDate>\n";
echo " </item>\n";
break;
case 'html':
default:
echo " <tr>\n";
echo " <td><a href=\"/$group/$articleNumber\">$articleNumber</a></td>\n";
echo " <td><a href=\"/$group/$articleNumber\">";
echo " <td><a href=\"$cleanArticlePath\">" . clean($articleNumber) . "</a></td>\n";
echo " <td><a href=\"$cleanArticlePath\">";
echo format_subject($details['subject'], $charset);
echo "</a></td>\n";
echo " <td class=\"vcard\">" . format_author($details['author'], $charset) . "</td>\n";
echo " <td class=\"align-center\"><span class='monospace mod-small'>" .
format_date($details['date']) . "</span></td>\n";
echo " <td class=\"align-right\">{$details['lines']}</td>\n";
echo " <td class=\"align-right\">" . clean($details['lines']) . "</td>\n";
echo " </tr>\n";
}
}
Expand Down
11 changes: 6 additions & 5 deletions index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@

head();

$DISPLAY_NNTP_HOST = htmlspecialchars(($NNTP_HOST == 'localhost') ? 'news.php.net' : $NNTP_HOST);
$CLEAN_DISPLAY_NNTP_HOST = clean(($NNTP_HOST == 'localhost') ? 'news.php.net' : $NNTP_HOST);
?>

<nav class="secondary-nav">
Expand All @@ -33,7 +33,7 @@
<p>
The PHP project collaborates across a number of mailing lists. The archives
are available through this site and via NNTP at
<a href="news://<?= $DISPLAY_NNTP_HOST ?>"> <?= $DISPLAY_NNTP_HOST ?></a>.
<a href="news://<?= $CLEAN_DISPLAY_NNTP_HOST ?>"> <?= $CLEAN_DISPLAY_NNTP_HOST ?></a>.
</p>
<p>
Instructions for subscribing to active lists by email can be found on the page
Expand Down Expand Up @@ -61,13 +61,14 @@
$last_status == 'y' ? 'Discussion Lists' : 'Inactive Lists',
"</th></tr>\n";
}
$cleanGroupUrl = urlencode($group);
echo " <tr>\n";
echo " <td><a class=\"active{$details['status']}\" href=\"/$group\">$group</a></td>\n";
echo " <td>", htmlspecialchars($descriptions[$group]), "</td>\n";
echo " <td><a class=\"active" . clean($details['status']) . "\" href=\"/$cleanGroupUrl\">" . clean($group) . "</a></td>\n";
echo " <td>", clean($descriptions[$group]), "</td>\n";
echo " <td class=\"align-right\">", $details['high'] - $details['low'] + 1, "</td>\n";
echo " <td class=\"align-center\">";
if ($details['status'] != 'n') {
echo "<a href=\"group.php?group=$group&amp;format=rss\">RSS</a>";
echo "<a href=\"group.php?group=$cleanGroupUrl&amp;format=rss\">RSS</a>";
}
echo "</td>\n";
echo " </tr>\n";
Expand Down
7 changes: 4 additions & 3 deletions lib/ThreadTree.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,12 +60,13 @@ protected function printArticleAndChildren($messageId, $group, $charset, $depth
#unset($this->articleNumbers[$messageId]);

$details = $this->articles[$articleNumber];
$cleanArticlePath = "/" . urlencode($group) . "/" . urlencode((string) $articleNumber);

echo " <tr>\n";
echo " <td align=\"center\"><a href=\"/$group/$articleNumber\">$articleNumber</a></td>\n";
echo " <td align=\"center\"><a href=\"$cleanArticlePath\">" . clean($articleNumber) . "</a></td>\n";
echo " <td>";
echo str_repeat("&nbsp; &nbsp;", $depth ?? 0);
echo "<a href=\"/$group/$articleNumber\">";
echo "<a href=\"$cleanArticlePath\">";
echo format_subject($details['subject'], $charset);
echo "</a></td>\n";
echo " <td class=\"vcard\">" . format_author($details['author'], $charset) . "</td>\n";
Expand Down Expand Up @@ -144,7 +145,7 @@ public function printThread(
$details = $this->articles[$articleNumber];

if ($articleNumber != $activeArticleNumber) {
echo "<a href=\"/$group/$articleNumber\">";
echo "<a href=\"/" . urlencode($group) . "/" . urlencode((string) $articleNumber) . "\">";
} else {
echo "<b>";
}
Expand Down
21 changes: 13 additions & 8 deletions lib/common.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,15 @@ function error($str)
{
head("PHP news : error");
echo "<section class=\"content\"><blockquote><strong>Error:</strong> ",
to_utf8($str), "</blockquote></section>\n";
clean(to_utf8($str)), "</blockquote></section>\n";
foot();
die();
}

/* Borrowed from web-php repo. */
function clean($var)
function clean($var): string
{
return htmlspecialchars($var, \ENT_QUOTES);
return htmlspecialchars((string) $var, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
}

// Try to check that this email address is valid
Expand Down Expand Up @@ -112,7 +112,7 @@ function head($title = "PHP Mailing Lists (PHP News)")
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?php echo htmlspecialchars($title); ?></title>
<title><?php echo clean($title); ?></title>
<link href="//fonts.googleapis.com/css?family=Fira+Sans|Source+Sans+Pro:300,400,600,400italic,600italic|Source+Code+Pro&amp;subset=latin,latin-ext" rel="stylesheet">
<link rel="stylesheet" href="/style.css" type="text/css" />
<link rel="shortcut icon" href="//www.php.net/favicon.ico">
Expand Down Expand Up @@ -246,7 +246,11 @@ function format_author($a, $charset = 'iso-8859-1', $nameOnly = false)
$email= spam_protect($ar[1]);
$name = $ar[2];
}
elseif (preg_match("/^\s*\"?(.+?)\"?\s*<(.+)>\s*$/", $a, $ar)) {

// Treat the address as one angle-bracketed part, so extra
// brackets in the display name do not confuse parsing.

elseif (preg_match("/^\s*\"?(.+?)\"?\s*<([^<>]+)>\s*$/", $a, $ar)) {
$email = spam_protect($ar[2]);
$name = $ar[1];
}
Expand All @@ -255,13 +259,14 @@ function format_author($a, $charset = 'iso-8859-1', $nameOnly = false)
} else {
$email = $name = $a;
}

$name = clean($name);

if ($nameOnly) {
return str_replace(" ", "&nbsp;", $name);
} else {
return "<a href=\"mailto:" .
htmlspecialchars(urlencode($email), ENT_QUOTES, "UTF-8") .
clean(urlencode($email)) .
"\" class=\"email fn n\">" .
str_replace(" ", "&nbsp;", $name) . "</a>";
}
Expand All @@ -281,7 +286,7 @@ function format_subject($s, $charset = 'iso-8859-1', $trimRe = false)
} else {
$s = wordwrap($s, 150);
}
return nl2br(htmlspecialchars($s, ENT_QUOTES, "UTF-8"));
return nl2br(clean($s));
}


Expand All @@ -296,7 +301,7 @@ function format_title($s, $charset = 'iso-8859-1', $trimRe = false)
} else {
$s = wordwrap($s, 150);
}
return htmlspecialchars($s, ENT_QUOTES, "UTF-8");
return clean($s);
}

function format_date($d, $format = 'r')
Expand Down
7 changes: 7 additions & 0 deletions lib/config.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,10 @@
if (getenv('NNTP_HOST')) {
$NNTP_HOST = getenv('NNTP_HOST');
}

$NEWS_WEB_BASE_URL = 'https://news.php.net';
if (getenv('NEWS_WEB_BASE_URL')) {
$NEWS_WEB_BASE_URL = rtrim(getenv('NEWS_WEB_BASE_URL'), '/');
} elseif (PHP_SAPI == 'cli-server') {
$NEWS_WEB_BASE_URL = 'http://' . $_SERVER['HTTP_HOST'];
}
6 changes: 3 additions & 3 deletions lib/group-navbar.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,19 @@ function navbar($g, $f, $l, $i)
echo ' <th class="nav">';
if ($i > $f) {
$p = max($i - 20, $f);
echo "<a href=\"/" . htmlspecialchars($g, ENT_QUOTES, "UTF-8") . "/start/$p\">",
echo "<a href=\"/" . urlencode($g) . "/start/$p\">",
"<b>&laquo; <span>previous</span></b></a>";
} else {
echo "&nbsp;";
}
echo '</th>' . "\n";
$j = min($i + 20, $l);
$c = $l - $f + 1;
echo ' <th class="align-center">' . htmlspecialchars($g, ENT_QUOTES, "UTF-8") . " ($i-$j of $c)</th>\n";
echo ' <th class="align-center">' . clean($g) . " ($i-$j of $c)</th>\n";
echo ' <th class="nav align-right">';
if ($i + 20 <= $l) {
$n = min($i + 20, $l - 19);
echo "<a href=\"/", htmlspecialchars($g, ENT_QUOTES, "UTF-8") . "/start/$n\">",
echo "<a href=\"/", urlencode($g) . "/start/$n\">",
"<b><span>next</span> &raquo;</b></a>";
} else {
echo "&nbsp;";
Expand Down