Changeset 3163

Timestamp:

05/18/2016 02:08:28 AM (10 years ago)

Author:

dd32

Message:

Plugin Directory: Readme parsing: Sanitize the stable tag from the readme, plugins often fill it with unexpected values.

This change also allows for a instance to be created without a file, and avoids a scenario where the plugin description may get picked up as the plugin name.

See #1584

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-readme-parser.php (modified) (4 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-readme-parser.php

@@ -56 +56 @@
 
         public function __construct( $file ) {
-                $this->parse_readme( $file );
+                if ( $file ) {
+                        $this->parse_readme( $file );
+                }
         }
 
@@ -81 +83 @@
                 if ( 'plugin name' == strtolower( $this->name ) ) {
                         $this->name = $line = $this->get_first_nonwhitespace( $contents );
-                        // Ensure that the line read wasn't an actual header
-                        if ( preg_match( '~^(' . implode( '|', array_keys( $this->valid_headers ) ) . ')\s*:~i', $line ) ) {
+                        // Ensure that the line read wasn't an actual header or description
+                        if ( strlen( $line ) > 50 || preg_match( '~^(' . implode( '|', array_keys( $this->valid_headers ) ) . ')\s*:~i', $line ) ) {
                                 $this->name = false;
                                 array_unshift( $contents, $line );
@@ -128 +130 @@
                 }
                 if ( ! empty( $headers['stable_tag'] ) ) {
-                        $this->stable_tag = $headers['stable_tag'];
+                        $this->stable_tag = $this->sanitize_stable_tag( $headers['stable_tag'] );
                 }
                 if ( ! empty( $headers['donate_link'] ) ) {
@@ -365 +367 @@
         }
 
+        /**
+         * Sanitize the provided stable tag to something we expect.
+         *
+         * @param string $stable_tag the raw Stable Tag line from the readme.
+         * @return string The sanitized $stable_tag.
+         */
+        protected function sanitize_stable_tag( $stable_tag ) {
+                $stable_tag = trim( $stable_tag );
+                $stable_tag = trim( $stable_tag, '"\'' ); // "trunk"
+                $stable_tag = preg_replace( '!^/?tags/!i', '', $stable_tag ); // "tags/1.2.3"
+                $stable_tag = preg_replace( '![^a-z0-9_.-]!i', '', $stable_tag );
+
+                return $stable_tag;
+        }
+
         protected function parse_markdown( $text ) {
                 static $markdown = null;