r49586 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r49585‎ | r49586 | r49587 >
Date:23:42, 16 April 2009
Author:siebrand
Status:reverted (Comments)
Tags:
Comment:
(bug 17949) Add support to chose language and colorscheme to SyntaxHighlight_vim. Patch contributed by Ben Roberts.
Modified paths:
  • /trunk/extensions/SyntaxHighlight_vim/Syntax.php (modified) (history)
  • /trunk/extensions/SyntaxHighlight_vim/SyntaxHook.php (modified) (history)
  • /trunk/extensions/SyntaxHighlight_vim/vimrc.vim (modified) (history)

Diff [purge]

Index: trunk/extensions/SyntaxHighlight_vim/vimrc.vim
@@ -4,6 +4,6 @@
55
66 set uc=0 " Disable swap files
77
8 -set background=dark
 8+set background=light
99
1010 colorscheme pablo
Index: trunk/extensions/SyntaxHighlight_vim/Syntax.php
@@ -19,9 +19,10 @@
2020 function wfSyntax() {
2121 wfUsePHP( 5.1 );
2222 wfUseMW( '1.6alpha' );
23 -
 23+
2424 class Syntax {
2525 private $mIn;
 26+ private $mInFormat, $mColorscheme;
2627 private $mInFile, $mOutFile;
2728 private $mVimrc;
2829
@@ -29,11 +30,13 @@
3031 $this->mVimrc = dirname( __FILE__ ) . DIRECTORY_SEPARATOR . 'vimrc.vim';
3132
3233 $this->mIn = $in;
 34+ $this->mInFormat = $format;
 35+ $this->mColorscheme = $colorscheme;
3336 }
3437
3538 public function getOut() {
3639 $this->genTemp();
37 -
 40+
3841 if ( ! $handle = fopen( $this->mInFile, 'a' ) )
3942 die( 'AAAAAAA' );
4043 if ( fwrite( $handle, $this->mIn ) === false )
@@ -45,7 +48,7 @@
4649 $html = preg_replace( '~</p>\s*</body>.*?$~s', '</style>', $html );
4750
4851 $this->rmTemp();
49 -
 52+
5053 return $html;
5154 }
5255
@@ -53,19 +56,22 @@
5457 $this->mInFile = $this->mktemp();
5558 $this->mOutFile = $this->mktemp();
5659 }
57 -
 60+
5861 private static function mktemp() {
5962 return rtrim( shell_exec( 'mktemp -u' ), "\n" );
6063 }
61 -
 64+
6265 private function rmTemp() {
6366 unlink( $this->mInFile );
6467 unlink( $this->mOutFile );
6568 }
6669
6770 private function run() {
68 - shell_exec( "vim -u {$this->mVimrc} -e +'run! syntax/2html.vim' +':w {$this->mOutFile}' +':qa!' {$this->mInFile}" );
69 -
 71+ $commands = '';
 72+ if( $this->mInFormat ) { $commands .= "+'set filetype={$this->mInFormat}' "; }
 73+ if( $this->mColorscheme ) { $commands .= "+'colorscheme {$this->mColorscheme}' "; }
 74+ shell_exec( "vim -u {$this->mVimrc} -e {$commands} +'run! syntax/2html.vim' +':w {$this->mOutFile}' +':qa!' {$this->mInFile}" );
 75+
7076 return file_get_contents( $this->mOutFile );
7177 }
7278 }
Index: trunk/extensions/SyntaxHighlight_vim/SyntaxHook.php
@@ -33,8 +33,13 @@
3434
3535 public function hook( $in, array $argv ) {
3636 $in = ltrim( $in, "\n" );
37 - $syntax = new Syntax( $in );
3837
 38+ $format = $colorscheme = null;
 39+ if( isset( $argv['lang'] ) ) { $format = $argv['lang']; }
 40+ if( isset( $argv['colorscheme'] ) ) { $colorscheme = $argv['colorscheme']; }
 41+
 42+ $syntax = new Syntax( $in, $format, $colorscheme );
 43+
3944 return $syntax->getOut();
4045 }
4146 }

Follow-up revisions

RevisionCommit summaryAuthorDate
r51425Reverted r49586, shell injection vulnerability noted on CodeReview.tstarling17:13, 3 June 2009

Comments

#Comment by Brion VIBBER (talk | contribs)   23:48, 28 April 2009

I don't see any validation on input here; looks like a shell injection vulnerability.

Status & tagging log