r37532 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r37531‎ | r37532 | r37533 >
Date:20:55, 10 July 2008
Author:brion
Status:old
Tags:
Comment:
Cleanup for r37495 (adds line highlighting support to geshi plugin):
* Break input validation out to a function so it doesn't mush up main program flow readability
* Reduce denial of service attack area by imposing an arbitrary limit on the size of line ranges
* Reject 0 as a valid input line

Some further notes:
* Currently, the line numbers given for highlighting seem to ignore the 'start' line number provided for displaying line numbers. This is IMHO a bit confusing; it might be better to add the start line number in so you can specify line numbers which match what will be displayed.
* You can specify line numbers after the end of the document without complaint. It might be better to count the lines and ignore any additional ones.
Modified paths:
  • /trunk/extensions/SyntaxHighlight_GeSHi/SyntaxHighlight_GeSHi.class.php (modified) (history)

Diff [purge]

Index: trunk/extensions/SyntaxHighlight_GeSHi/SyntaxHighlight_GeSHi.class.php
@@ -45,27 +45,11 @@
4646 $enclose = GESHI_HEADER_DIV;
4747 $geshi->enable_line_numbers( GESHI_FANCY_LINE_NUMBERS );
4848 }
49 - // Highlightning
 49+ // Highlighting specific lines
5050 if( isset( $args['highlight'] ) ) {
51 - $lines = array();
52 - $values = array_map( 'trim', explode( ',', $args['highlight'] ) );
53 - foreach ( $values as $value ) {
54 - if ( ctype_digit($value) ) {
55 - $lines[] = (int) $value;
56 - } elseif ( strpos( $value, '-' ) !== false ) {
57 - list( $start, $end ) = array_map( 'trim', explode( '-', $value ) );
58 - if ( ctype_digit($start) && ctype_digit($end) && $start < $end ) {
59 - for ($i = $start; $i <= $end; $i++ ) $lines[] = $i;
60 - } else {
61 - wfDebugLog( 'geshi', "Invalid range: $value\n" );
62 - }
63 - } else {
64 - wfDebugLog( 'geshi', "Invalid line: $value\n" );
65 - }
66 - }
 51+ $lines = self::parseHighlightLines( $args['highlight'] );
6752 if ( count($lines) ) $geshi->highlight_lines_extra( $lines );
6853 }
69 -
7054 // Starting line number
7155 if( isset( $args['start'] ) )
7256 $geshi->start_line_numbers_at( $args['start'] );
@@ -88,6 +72,55 @@
8973 return '<div dir="ltr" style="text-align: left;">' . $out . '</div>';
9074 }
9175 }
 76+
 77+ /**
 78+ * Take an input specifying a list of lines to highlight, returning
 79+ * a raw list of matching line numbers.
 80+ *
 81+ * Input is comma-separated list of lines or line ranges.
 82+ *
 83+ * @input string
 84+ * @return array of ints
 85+ */
 86+ protected static function parseHighlightLines( $arg ) {
 87+ $lines = array();
 88+ $values = array_map( 'trim', explode( ',', $arg ) );
 89+ foreach ( $values as $value ) {
 90+ if ( ctype_digit($value) ) {
 91+ $lines[] = (int) $value;
 92+ } elseif ( strpos( $value, '-' ) !== false ) {
 93+ list( $start, $end ) = array_map( 'trim', explode( '-', $value ) );
 94+ if ( self::validHighlightRange( $start, $end ) ) {
 95+ for ($i = intval( $start ); $i <= $end; $i++ ) {
 96+ $lines[] = $i;
 97+ }
 98+ } else {
 99+ wfDebugLog( 'geshi', "Invalid range: $value\n" );
 100+ }
 101+ } else {
 102+ wfDebugLog( 'geshi', "Invalid line: $value\n" );
 103+ }
 104+ }
 105+ return $lines;
 106+ }
 107+
 108+ /**
 109+ * Validate a provided input range
 110+ */
 111+ protected function validHighlightRange( $start, $end ) {
 112+ // Since we're taking this tiny range and producing a an
 113+ // array of every integer between them, it would be trivial
 114+ // to DoS the system by asking for a huge range.
 115+ // Impose an arbitrary limit on the number of lines in a
 116+ // given range to reduce the impact.
 117+ $arbitrarilyLargeConstant = 10000;
 118+ return
 119+ ctype_digit($start) &&
 120+ ctype_digit($end) &&
 121+ $start > 0 &&
 122+ $start < $end &&
 123+ $end - $start < $arbitrarilyLargeConstant;
 124+ }
92125
93126 /**
94127 * Hook into Article::view() to provide syntax highlighting for

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r37495* Add highlight support: highlight=3,6-7nikerabbit12:45, 10 July 2008

Status & tagging log