Changeset 10429

Timestamp:

11/05/2020 03:37:13 AM (6 years ago)

Author:

dd32

Message:

Plugin Directory: Readme Parser: Allow a File, URL, or now the raw readme contents to be passed to the Readme Parser.

This eases integration and re-use of the parser for other purposes.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/readme

Files:

• class-parser.php (modified) (2 diffs)
• class-validator.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/readme/class-parser.php

@@ -153 +153 @@
          * Parser constructor.
          *
-         * @param string $file_or_url
-         */
-        public function __construct( $file_or_url ) {
-                if ( $file_or_url ) {
-                        $this->parse_readme( $file_or_url );
+         * @param string $string A Filepath, URL, or contents of a readme to parse.
+         */
+        public function __construct( $string ) {
+                if ( file_exists( $string ) || preg_match( '!^https?://!i', $string ) ) {
+                        $this->parse_readme( $string );
+                } elseif ( $string ) {
+                        $this->parse_readme_contents( $string );
                 }
         }
@@ -174 +176 @@
                 $contents = file_get_contents( $file_or_url, false, $context );
 
+                return $this->parse_readme_contents( $contents );
+        }
+
+        /**
+         * @param string $contents The contents of the readme to parse.
+         * @return bool
+         */
+        protected function parse_readme_contents( $contents ) {
                 if ( preg_match( '!!u', $contents ) ) {
                         $contents = preg_split( '!\R!u', $contents );

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/readme/class-validator.php

@@ -64 +64 @@
         public function validate_content( $readme ) {
 
+                // Security note: Keep the data: protocol here, Parser accepts a string HOWEVER
+                // if a submitted readme.txt URL contents were to contain a file or URL-like string,
+                // it could bypass the protections above in validate_url().
                 $readme = new Parser( 'data:text/plain,' . urlencode( $readme ) );