gollum-lib 4.0.1 → 4.0.2

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    OWViYjc2ZTIxNmQ2NGFmMWJjNmQ2MGIyNTZjYjdhNmRjYmYxODBjMg==
+    N2Y4ZGU4MTBjNjg3YjBjNzVmNjNjZTE1ZjgzNWJjOWYwNGRhOGZjYw==
   data.tar.gz: !binary |-
-    YWMyMGE0OTJjMjYzOTIyZDliZWE0MDNlZTJlZmVmMGQ1MmQyYTdlYw==
+    ZmZiMTllMGJiMWRhNzUyMDIyNDUzZWZlMjBkNjlkYTNhMjAyN2UwOA==
 SHA512:
   metadata.gz: !binary |-
-    ZTMyN2YwNDQxZGY3ZTUxZDI1YjNjNGY0M2QyNjFmYmE4MjgyZWU5YWU5NDA0
-    NTJkMGZlZDcyZTgxYmU5N2M4ZjgzMGVlMGZlMGJjODM0ZjU5M2U3NGYzYWRk
-    NmE3MDU4YjEwOTVhYWQ0NjdkYzhmZTAwMGExNDRiYjk1ZjU4Yzc=
+    NDFmMDkyODFlZjc0YzJmMGNkNWIwNmI4NTk0OGJkYWQ1MTIwYzY3MTlkZjRh
+    N2ZjOTA5ODgwYjJkOGUyMzU1YTczN2EwOGJjMWQxMGMwYmIxMzE1NWJlZDBj
+    ZjJhNzc1ZDZjOTFjNGZkZTkzYTkxNGQxN2YxYjNkM2FhYzkzNTE=
   data.tar.gz: !binary |-
-    MjExY2VhY2M1MmZkNDBiMDU1MGFjZGZkMDNhZWFiN2VjYTI3NWE5MTVmZGNi
-    ODk2OTlkNTkxYjViMGVhMjYyYjUzNDhkY2Q4NmI5N2ZmZWYyNzE5ZTMyMmNm
-    ODcwZmM0Y2QzMWNhOGI0MTZhOTJkNzMwZDZhMTA2YjhmYzlmYjk=
+    N2FkZGIwZGU5YTZkM2NiNGYwMWMzOGEyMDU1Yzc5MzcxYmU3N2MwNzdkMWIz
+    MTYwOGQ1OTViNmJmMmM2ZmQ3NWM1OTQyMDVlYTYwYjJhOTYwNThlZmZiNDMz
+    OTU5NzM2ZGFkOGQxZmY0YjZiOTYxYzMwMmZlOGViYzFmMWQ4YTE=

data/HISTORY.md

@@ -1,3 +1,11 @@
+# v4.0.2 /2015-0119
+
+* Bugfixes
+
+# v4.0.1 /2014-12-04
+
+* Security fix for [remote code execution issue](https://github.com/gollum/gollum/issues/913). Please update!
+
 # v0.0.1 / 2013-03-19
 
 * First release, extrated from https://github.com/gollum/gollum

data/gollum-lib.gemspec

@@ -5,8 +5,8 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 1.9'
 
   s.name              = 'gollum-lib'
-  s.version           = '4.0.1'
-  s.date              = '2014-12-04'
+  s.version           = '4.0.2'
+  s.date              = '2015-01-19'
   s.rubyforge_project = 'gollum-lib'
   s.license           = 'MIT'
 

data/lib/gollum-lib.rb

@@ -38,7 +38,7 @@ $KCODE = 'U' if RUBY_VERSION[0, 3] == '1.8'
 
 module Gollum
   module Lib
-    VERSION = '4.0.1'
+    VERSION = '4.0.2'
   end
 
   def self.assets_path

data/lib/gollum-lib/filter/code.rb

@@ -5,46 +5,42 @@
 # Render a block of code using the Rouge syntax-highlighter.
 class Gollum::Filter::Code < Gollum::Filter
   def extract(data)
-    return data if @markup.format == :txt
+    case @markup.format
+      when :txt
+        return data
+      when :asciidoc
+        data.gsub!(/^(\[source,([^\r\n]*)\]\n)?----\n(.+?)\n----$/m) do
+          cache_codeblock($2, $3)
+        end
+      when :org
+        org_headers = %r{([ \t]*#\+HEADER[S]?:[^\r\n]*\n)*}
+        org_name = %r{([ \t]*#\+NAME:[^\r\n]*\n)?}
+        org_lang = %r{[ ]*([^\n \r]*)[ ]*[^\r\n]*}
+        org_begin = %r{[ \t]*#\+BEGIN_SRC#{org_lang}\n}
+        org_end = %r{\n[ \t]*#\+END_SRC[ \t]*}
+        data.gsub!(/^#{org_headers}#{org_name}#{org_begin}(.+?)#{org_end}$/mi) do
+          cache_codeblock($3, $4)
+        end
+    end
     data.gsub!(/^([ \t]*)(~~~+) ?([^\r\n]+)?\r?\n(.+?)\r?\n\1(~~~+)[ \t\r]*$/m) do
       m_indent = $1
       m_start  = $2 # ~~~
       m_lang   = $3
       m_code   = $4
       m_end    = $5 # ~~~
-
       # start and finish tilde fence must be the same length
       next '' if m_start.length != m_end.length
-
-      lang   = m_lang ? m_lang.strip : nil
-      id     = Digest::SHA1.hexdigest("#{lang}.#{m_code}")
-      cached = @markup.check_cache(:code, id)
-
-      # extract lang from { .ruby } or { #stuff .ruby .indent }
-      # see http://johnmacfarlane.net/pandoc/README.html#delimited-code-blocks
-
+      lang = m_lang ? m_lang.strip : nil
       if lang
         lang = lang.match(/\.([^}\s]+)/)
         lang = lang[1] unless lang.nil?
       end
-
-      @map[id] = cached ?
-          { :output => cached } :
-          { :lang => lang, :code => m_code, :indent => m_indent }
-
-      "#{m_indent}#{id}" # print the SHA1 ID with the proper indentation
+      "#{m_indent}#{cache_codeblock(lang, m_code, m_indent)}"
     end
 
     data.gsub!(/^([ \t]*)``` ?([^\r\n]+)?\r?\n(.+?)\r?\n\1```[ \t]*\r?$/m) do
-      lang     = $2 ? $2.strip : nil
-      id       = Digest::SHA1.hexdigest("#{lang}.#{$3}")
-      cached   = @markup.check_cache(:code, id)
-      @map[id] = cached ?
-          { :output => cached } :
-          { :lang => lang, :code => $3, :indent => $1 }
-      "#{$1}#{id}" # print the SHA1 ID with the proper indentation
+      "#{$1}#{cache_codeblock($2.to_s.strip, $3, $1)}" # print the SHA1 ID with the proper indentation
     end
-
     data
   end
 
@@ -136,4 +132,14 @@ class Gollum::Filter::Code < Gollum::Filter
       end
     end
   end
+
+  def cache_codeblock(language, code, indent = "")
+    language = language.to_s.empty? ? nil : language
+    id = Digest::SHA1.hexdigest("#{language}.#{code}")
+    cached = @markup.check_cache(:code, id)
+    @map[id] = cached ?
+      { :output => cached } :
+      { :lang => language, :code => code, :indent => indent }
+    id
+  end
 end

data/lib/gollum-lib/filter/macro.rb

@@ -10,10 +10,11 @@ class Gollum::Filter::Macro < Gollum::Filter
     arg = %r{(?:#{quoted_arg}|#{unquoted_arg}|#{named_arg})}
     arg_list = %r{(\s*|#{arg}(?:\s*,\s*#{arg})*)}
 
-    data.gsub(/\<\<\s*([A-Z][A-Za-z0-9]*)\s*\(#{arg_list}\)\s*\>\>/) do
-      id = Digest::SHA1.hexdigest($1 + $2)
-      macro = $1
-      argstr = $2
+    data.gsub(/('?)\<\<\s*([A-Z][A-Za-z0-9]*)\s*\(#{arg_list}\)\s*\>\>/) do
+      next CGI.escape_html($&[1..-1]) unless $1.empty?
+      id = Digest::SHA1.hexdigest($2 + $3)
+      macro = $2
+      argstr = $3
       args = []
       opts = {}
       

data/lib/gollum-lib/filter/toc.rb

@@ -9,7 +9,7 @@ class Gollum::Filter::TOC < Gollum::Filter
     @doc               = Nokogiri::HTML::DocumentFragment.parse(data)
     @toc               = nil
     @anchor_names      = {}
-    @current_ancestors = ""
+    @current_ancestors = []
 
     if @markup.sub_page && @markup.parent_page
       @toc = @markup.parent_page.toc_data
@@ -57,12 +57,9 @@ class Gollum::Filter::TOC < Gollum::Filter
     name.gsub!(/-$/, "")
     name.downcase!
 
-    anchor_name = name
-
-    # Set and/or add the ancestors to the name
-    @current_ancestors = name if level == 1
-    anchor_name = (level == 1) ? name : "#{@current_ancestors}_#{name}"
-    @current_ancestors+= "_#{name}" if level > 1
+    @current_ancestors[level - 1] = name
+    @current_ancestors = @current_ancestors.take(level)
+    anchor_name = @current_ancestors.compact.join("_")
 
     # Ensure duplicate anchors have a unique prefix or the toc will break
     index = increment_anchor_index(anchor_name)

data/lib/gollum-lib/wiki.rb

@@ -607,7 +607,7 @@ module Gollum
         # Remove ext only from known extensions.
         # test.pdf => test.pdf, test.md => test
         file_name = Page::valid_page_name?(name) ? name.chomp(::File.extname(name)) : name
-        results[file_name] = count
+        results[file_name] = count.to_i
       end
 
       # Use git ls-files '*query*' to search for file names. Grep only searches file content.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gollum-lib
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.0.2
 platform: ruby
 authors:
 - Tom Preston-Werner
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-04 00:00:00.000000000 Z
+date: 2015-01-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gollum-grit_adapter