Changeset 10429

Timestamp:

11/05/2020 03:37:13 AM (5 years ago)

Author:

dd32

Message:

Plugin Directory: Readme Parser: Allow a File, URL, or now the raw readme contents to be passed to the Readme Parser.

This eases integration and re-use of the parser for other purposes.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/readme

Files:

• class-parser.php (modified) (2 diffs)
• class-validator.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/readme/class-parser.php

@@ -153 +153 @@
      * Parser constructor.
      *
-     * @param string $file_or_url
-     */
-    public function __construct( $file_or_url ) {
-        if ( $file_or_url ) {
-            $this->parse_readme( $file_or_url );
+     * @param string $string A Filepath, URL, or contents of a readme to parse.
+     */
+    public function __construct( $string ) {
+        if ( file_exists( $string ) || preg_match( '!^https?://!i', $string ) ) {
+            $this->parse_readme( $string );
+        } elseif ( $string ) {
+            $this->parse_readme_contents( $string );
         }
     }
@@ -174 +176 @@
         $contents = file_get_contents( $file_or_url, false, $context );
 
+        return $this->parse_readme_contents( $contents );
+    }
+
+    /**
+     * @param string $contents The contents of the readme to parse.
+     * @return bool
+     */
+    protected function parse_readme_contents( $contents ) {
         if ( preg_match( '!!u', $contents ) ) {
             $contents = preg_split( '!\R!u', $contents );

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/readme/class-validator.php

@@ -64 +64 @@
     public function validate_content( $readme ) {
 
+        // Security note: Keep the data: protocol here, Parser accepts a string HOWEVER
+        // if a submitted readme.txt URL contents were to contain a file or URL-like string,
+        // it could bypass the protections above in validate_url().
         $readme = new Parser( 'data:text/plain,' . urlencode( $readme ) );