tdiary 5.5.0 → 5.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2848172a6d8df4abfcaceb2c4b5c36b2437d7f5a5a6f54ca18aa5f62af1bdf24
-  data.tar.gz: 6d8500306d06afd3e3187fbf7dcac0587f9ec90814eab1c82cc6b877f7ba9e84
+  metadata.gz: c52912654a8c3f8dcbef538b3ca818e71a46adea1416c691d76792747cf3d9a8
+  data.tar.gz: 2f578f65c5c636012a3971508916a1f463f37c4039d4bb8d9654c24720b6eb8f
 SHA512:
-  metadata.gz: e518cb0d2aaeafd1a7b0433408917cf5e77a191456bd3337c30a8cb3858c969b7c0797d4d015051a50f48fc04ba06426928384ef2ef861524cf2c9e6ebc67652
-  data.tar.gz: 58dcf7e6d00f5ee99c5cc9ef2952c36a8a4bc693ef4efbeb3d350f5a371d27fa450bac145d5abf4731ee4defee4b2130ad11eae9af4a354360efaf74243fc9a8
+  metadata.gz: 66fd5778cfbe863790cda5a64a3cd8812b28d6dd3434f08ce710fec49044986cb0677599d8f58055d05f4001734b2374ec7397b4ed04f7e0ea7b912b76d372ee
+  data.tar.gz: a2ddcc2c75d34cc2cd2cbbb669395b900b5a930dc129312ee325a960652995d0af04d2511f0f039e332fe461ed3dbcf4efd148abdf29ba5b167a8a99598fa28f

data/ChangeLog

@@ -1,3 +1,5 @@
+This ChangeLog is no longer updated. Changes in 5.5.0 and later are recorded in the release notes at https://github.com/tdiary/tdiary-core/releases.
+
 2025-06-13 Hiroshi SHIBATA <hsbt@ruby-lang.org>
 	* support Ruby 3.4.
 	* drop to support Ruby 3.0.

data/Gemfile

@@ -12,6 +12,7 @@ gem 'mail'
 gem 'rake'
 gem 'cgi'
 gem 'pstore'
+gem 'logger'
 
 group :development do
   gem 'pit', require: false
@@ -24,7 +25,7 @@ group :development do
     gem 'rspec'
     gem 'capybara', require: 'capybara/rspec'
     gem 'date', '>= 3.1.1' # for compatibility of capybara
-    gem 'selenium-webdriver', '< 4.45' # 4.45+ requires Ruby >= 3.3
+    gem 'cuprite'
     gem 'launchy'
     gem 'sequel'
     gem 'sqlite3'

data/Gemfile.lock

@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/tdiary/tdiary-contrib.git
-  revision: b4fa12059634cfb6cea6e1a7d1b1d6341bd4024b
+  revision: 79c4f1909a8941a9f7feb856b8213af74a8e6cf3
   specs:
     tdiary-contrib (5.4.0)
       coderay
@@ -69,17 +69,25 @@ GEM
     commonmarker (2.9.0-x86_64-linux-musl)
     concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
-    dalli (5.0.5)
+    cuprite (0.17)
+      capybara (~> 3.0)
+      ferrum (~> 0.17.0)
+    dalli (5.1.0)
       logger
     date (3.5.1)
     diff-lcs (1.6.2)
-    docile (1.4.1)
     drb (2.2.3)
     emot (0.0.4)
       thor
     faraday (0.17.6)
       multipart-post (>= 1.2, < 3)
     fastimage (2.4.1)
+    ferrum (0.17.2)
+      addressable (~> 2.5)
+      base64 (~> 0.2)
+      concurrent-ruby (~> 1.1)
+      webrick (~> 1.7)
+      websocket-driver (~> 0.7)
     hashie (5.1.0)
       logger
     hikidoc (0.1.1)
@@ -105,7 +113,7 @@ GEM
     mime-types (3.7.0)
       logger
       mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2025.0603)
+    mime-types-data (3.2026.0701)
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
     minitest (6.0.6)
@@ -122,12 +130,12 @@ GEM
       bigdecimal (>= 3.1, < 5)
     multipart-post (2.4.1)
     mutex_m (0.3.0)
-    net-imap (0.5.15)
+    net-imap (0.6.6)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
-    net-protocol (0.2.2)
+    net-protocol (0.3.0)
       timeout
     net-smtp (0.5.1)
       net-protocol
@@ -184,7 +192,7 @@ GEM
       faraday (>= 0.13.0, < 1.0)
       mime-types
     racc (1.8.1)
-    rack (3.2.6)
+    rack (3.2.7)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
@@ -222,44 +230,32 @@ GEM
       rspec-support (~> 3.13.0)
     rspec-support (3.13.6)
     ruby2_keywords (0.0.5)
-    rubyzip (2.4.1)
     securerandom (0.4.1)
-    selenium-webdriver (4.33.0)
-      base64 (~> 0.2)
-      logger (~> 1.4)
-      rexml (~> 3.2, >= 3.2.5)
-      rubyzip (>= 1.2.2, < 3.0)
-      websocket (~> 1.0)
-    sequel (5.106.0)
+    sequel (5.107.0)
       bigdecimal
-    simplecov (0.22.0)
-      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.13.1)
-    simplecov_json_formatter (0.1.4)
+    simplecov (1.1.1)
     snaky_hash (2.0.7)
       hashie (>= 0.1.0, < 6)
       version_gem (~> 1.1, >= 1.1.14)
-    sqlite3 (2.8.1)
+    sqlite3 (2.9.6)
       mini_portile2 (~> 2.8.0)
-    sqlite3 (2.8.1-aarch64-linux-gnu)
-    sqlite3 (2.8.1-aarch64-linux-musl)
-    sqlite3 (2.8.1-arm-linux-gnu)
-    sqlite3 (2.8.1-arm-linux-musl)
-    sqlite3 (2.8.1-arm64-darwin)
-    sqlite3 (2.8.1-x86-linux-gnu)
-    sqlite3 (2.8.1-x86-linux-musl)
-    sqlite3 (2.8.1-x86_64-darwin)
-    sqlite3 (2.8.1-x86_64-linux-gnu)
-    sqlite3 (2.8.1-x86_64-linux-musl)
-    tdiary (5.4.0)
-      bundler (>= 2.6, < 3.0)
+    sqlite3 (2.9.6-aarch64-linux-gnu)
+    sqlite3 (2.9.6-aarch64-linux-musl)
+    sqlite3 (2.9.6-arm-linux-gnu)
+    sqlite3 (2.9.6-arm-linux-musl)
+    sqlite3 (2.9.6-arm64-darwin)
+    sqlite3 (2.9.6-x86-linux-gnu)
+    sqlite3 (2.9.6-x86-linux-musl)
+    sqlite3 (2.9.6-x86_64-darwin)
+    sqlite3 (2.9.6-x86_64-linux-gnu)
+    sqlite3 (2.9.6-x86_64-linux-musl)
+    tdiary (5.5.1)
+      cgi
       emot
       fastimage
       hikidoc
       mail
-      nkf
+      pstore
       rack
       rake
       rexml
@@ -285,7 +281,10 @@ GEM
     unf_ext (0.0.9.1)
     version_gem (1.1.14)
     webrick (1.9.2)
-    websocket (1.2.11)
+    websocket-driver (0.8.2)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
 
@@ -311,12 +310,14 @@ DEPENDENCIES
   capybara
   cgi
   connection_pool
+  cuprite
   dalli
   date (>= 3.1.1)
   emot
   fastimage
   hikidoc
   launchy
+  logger
   mail
   memcachier
   mime-types
@@ -334,7 +335,6 @@ DEPENDENCIES
   redcarpet
   rexml
   rspec
-  selenium-webdriver (< 4.45)
   sequel
   simplecov
   sqlite3

data/doc/UPGRADE.md

@@ -4,7 +4,7 @@
 このドキュメントについて
 --
 
-tDiaryは、バージョン番号が「X.Y.Z」の形式のものがリリースバージョン、その後ろに「.YYYYMMDD」形式で日付が入っているものが開発バージョンとなっています。このドキュメントでは、リリースバージョン間の変更点について解説します。開発バージョンを使っている場合は、ChangeLogファイルを参照してください。
+tDiaryは、バージョン番号が「X.Y.Z」の形式のものがリリースバージョン、その後ろに「.YYYYMMDD」形式で日付が入っているものが開発バージョンとなっています。このドキュメントでは、リリースバージョン間の変更点について解説します。開発バージョンを使っている場合は、[GitHub Releases](https://github.com/tdiary/tdiary-core/releases)を参照してください。
 
 4.0と5.0の違い
 -----

data/lib/tdiary/admin.rb

@@ -8,7 +8,7 @@ module TDiary
 			super
 
 			begin
-				@date = Time::local( @cgi.params['year'][0].to_i, @cgi.params['month'][0].to_i, @cgi.params['day'][0].to_i )
+				@date = Time::local( @request.param('year').to_i, @request.param('month').to_i, @request.param('day').to_i )
 			rescue ArgumentError, NameError
 				raise TDiaryError, 'bad date'
 			end
@@ -71,12 +71,12 @@ module TDiary
 		def initialize( cgi, rhtm, conf )
 			super
 
-			@title = @cgi.params['title'][0]
-			@body = @cgi.params['body'][0]
+			@title = @request.param('title')
+			@body = @request.param('body')
 			@title = @conf.to_native( @title )
 			@body = @conf.to_native( @body )
-			@old_date = @cgi.params['old'][0]
-			@hide = @cgi.params['hide'][0] == 'true' ? true : false
+			@old_date = @request.param('old')
+			@hide = @request.param('hide') == 'true' ? true : false
 
 			@io.transaction( @date ) do |diaries|
 				@diaries = diaries
@@ -107,13 +107,11 @@ module TDiary
 	#
 	class TDiaryUpdate < TDiaryAdmin
 		def initialize( request, rhtml, conf )
-			# @cgi is not derived yet before super; go through the facade here
-			params = request.cgi_compat.params
-			@title = params['title'][0]
-			@body = params['body'][0]
+			@title = request.param('title')
+			@body = request.param('body')
 			@title = conf.to_native( @title )
 			@body = conf.to_native( @body )
-			@hide = params['hide'][0] == 'true' ? true : false
+			@hide = request.param('hide') == 'true' ? true : false
 			super
 		end
 
@@ -140,7 +138,7 @@ module TDiary
 				@date = newdate
 			end
 
-			@author = @conf.multi_user ? @cgi.remote_user : nil
+			@author = @conf.multi_user ? @request.remote_user : nil
 
 			@io.transaction( @date ) do |diaries|
 				@diaries = diaries
@@ -166,7 +164,7 @@ module TDiary
 	class TDiaryReplace < TDiaryUpdate
 		def initialize( cgi, rhtm, conf )
 			super
-			old_date = @cgi.params['old'][0]
+			old_date = @request.param('old')
 
 			@io.transaction( @date ) do |diaries|
 				@diaries = diaries
@@ -203,7 +201,7 @@ module TDiary
 				if @diary then
 					idx = 0
 					@diary.each_comment do |com|
-						com.show = @cgi.params[(idx += 1).to_s][0] == 'true' ? true : false;
+						com.show = @request.param((idx += 1).to_s) == 'true' ? true : false;
 					end
 					self << @diary
 					@io.clear_cache( /(latest|#{@date.strftime( '%Y%m' )})/ )

data/lib/tdiary/application.rb

@@ -15,6 +15,7 @@ module TDiary
 			base_dir ||= self.base_dir
 
 			@app = ::Rack::Builder.app do
+				use TDiary::Rack::ErrorHandler
 				map base_dir do
 					map '/' do
 						use TDiary::Rack::HtmlAnchor
@@ -39,13 +40,7 @@ module TDiary
 		end
 
 		def call( env )
-			begin
-				@app.call( env )
-			rescue Exception => e
-				body = ["#{e.class}: #{e}\n"]
-				body << e.backtrace.join("\n")
-				[500, {'content-type' => 'text/plain'}, body]
-			end
+			@app.call( env )
 		end
 
 		def assets_paths

data/lib/tdiary/author_only_base.rb

@@ -6,6 +6,68 @@ module TDiary
 	class TDiaryAuthorOnlyBase < TDiaryBase
 		def csrf_protection_get_is_okay; false; end
 
+		# pure decision helpers for csrf_check, class methods so unit specs
+		# can exercise them without building a full TDiaryBase
+
+		# referer must be non-empty with its query string stripped; it is
+		# allowed when it names the update page itself or matches the
+		# admin-configured regexp
+		def self.csrf_referer_allowed?( referer, config_uri, allowed_referer_regexp )
+			return true if config_uri == URI.parse( referer )
+			allowed_referer_regexp != '' && Regexp.new( allowed_referer_regexp ).match?( referer )
+		end
+
+		# normalize an absolute http(s) URL to its origin serialization
+		# (lowercase scheme://host, default port omitted); nil when the
+		# input has no usable origin
+		def self.csrf_origin_of( url )
+			uri = URI.parse( url.to_s )
+			return nil unless uri.kind_of?( URI::HTTP ) and uri.host
+			port = uri.port == uri.default_port ? '' : ":#{uri.port}"
+			"#{uri.scheme.downcase}://#{uri.host.downcase}#{port}"
+		rescue URI::InvalidURIError
+			nil
+		end
+
+		# classify the request provenance from browser fetch metadata:
+		# :same_origin / :cross_site / :unknown (no usable signal, e.g.
+		# non-browser clients or a user-initiated navigation)
+		def self.csrf_fetch_verdict( origin, sec_fetch_site, allowed_origins )
+			if origin and !origin.empty?
+				# 'null' (sandboxed or opaque initiators) never matches
+				return allowed_origins.include?( origin.downcase ) ? :same_origin : :cross_site
+			end
+			case sec_fetch_site
+			when 'same-origin'
+				:same_origin
+			when 'same-site', 'cross-site'
+				:cross_site
+			else
+				:unknown
+			end
+		end
+
+		# main csrf decision: Origin / Sec-Fetch-Site first, the legacy
+		# Referer check only as a fallback when neither header gives a
+		# usable signal. A cross-site verdict can still be allowed by an
+		# explicit Referer allowance (the update page itself or the
+		# admin-configured regexp), but not by the empty-referer tolerance
+		# of check_referer=false.
+		def self.csrf_provenance_ok?( origin, sec_fetch_site, referer, allowed_origins, config_uri, allowed_referer_regexp, check_referer )
+			case csrf_fetch_verdict( origin, sec_fetch_site, allowed_origins )
+			when :same_origin
+				true
+			when :cross_site
+				referer != '' && csrf_referer_allowed?( referer, config_uri, allowed_referer_regexp )
+			else
+				if referer == ''
+					!check_referer
+				else
+					csrf_referer_allowed?( referer, config_uri, allowed_referer_regexp )
+				end
+			end
+		end
+
 		def initialize( cgi, rhtml, conf )
 			super
 			csrf_check( @request, conf )
@@ -43,8 +105,7 @@ module TDiary
 
 			referer_is_empty = referer == ''
 			referer_uri = URI.parse(referer) if !referer_is_empty
-			referer_is_config = !referer_is_empty && config_uri == referer_uri
-			referer_is_config ||= Regexp.new(updaterb_regexp) =~ referer if !referer_is_empty && updaterb_regexp != ''
+			referer_is_config = !referer_is_empty && self.class.csrf_referer_allowed?(referer, config_uri, updaterb_regexp)
 			is_post = request.post?
 
 			given_key = request.params['csrf_protection_key']
@@ -53,12 +114,18 @@ module TDiary
 			is_key_ok = masterkey != '' && given_key == masterkey
 
 			keycheck_ok = !check_key || is_key_ok
-			referercheck_ok = referer_is_config || (!check_referer && referer_is_empty)
+
+			origin = request.env['HTTP_ORIGIN']
+			sec_fetch_site = request.env['HTTP_SEC_FETCH_SITE']
+			allowed_origins = [base_uri, config_uri, request.base_url].map {|url|
+				self.class.csrf_origin_of( url )
+			}.compact.uniq
+			provenance_ok = self.class.csrf_provenance_ok?( origin, sec_fetch_site, referer, allowed_origins, config_uri, updaterb_regexp, check_referer )
 
 			if csrf_protection_get_is_okay then
 				return if is_post || given_key == nil
 			else
-				return if keycheck_ok && referercheck_ok
+				return if keycheck_ok && provenance_ok
 			end
 
 			raise Exception.new(<<"EOS")
@@ -69,6 +136,8 @@ Security Error: Possible Cross-site Request Forgery (CSRF)
                 - Mode is #{ self.mode || 'unknown' }
                     - GET is #{ csrf_protection_get_is_okay ? '' : 'not '}allowed
                 - Request Method is #{ is_post ? 'POST' : 'not POST' }
+                - Origin is #{ origin ? h(origin) : 'nothing' }
+                - Sec-Fetch-Site is #{ sec_fetch_site ? h(sec_fetch_site) : 'nothing' }
                 - Referer is #{ referer_is_empty ? 'empty' : referer_is_config ? 'config' : 'another page' }
                     - Given referer:       #{h referer_uri.to_s}
                     - Expected base URI:   #{h base_uri.to_s}
@@ -91,11 +160,11 @@ EOS
 		def initialize( cgi, rhtm, conf )
 			super
 
-			if @cgi.valid?( 'date' ) then
-				if @cgi.params['date'][0].kind_of?( String ) then
-					date = @cgi.params['date'][0]
+			if @request.valid?( 'date' ) then
+				if @request.param('date').kind_of?( String ) then
+					date = @request.param('date')
 				else
-					date = @cgi.params['date'][0].read
+					date = @request.param('date').read
 				end
 				@date = Time::local( *date.scan( /(\d{4})(\d\d)(\d\d)/ )[0] )
 			else
@@ -125,7 +194,7 @@ EOS
 
 		def initialize( cgi, rhtml, conf )
 			super
-			@key = @cgi.params['conf'][0] || ''
+			@key = @request.param('conf') || ''
 		end
 	end
 

data/lib/tdiary/base.rb

@@ -203,7 +203,7 @@ module TDiary
 		def initialize(cgi, rhtml, conf)
 			super
 
-			tdiary = tdiary_class(@cgi.params['date'][0] || '').new(@request, '', conf)
+			tdiary = tdiary_class(@request.param('date') || '').new(@request, '', conf)
 			@date = tdiary.date
 			@diaries = tdiary.diaries
 			@last_modified = Time.now
@@ -221,7 +221,7 @@ module TDiary
 
 		def plugin_name
 			# plugin name MUST contain only words ([a-zA-Z0-9_])
-			@plugin_name ||= (@cgi.params['plugin'][0] || '').match(/^(\w+)$/).to_a[1]
+			@plugin_name ||= (@request.param('plugin') || '').match(/^(\w+)$/).to_a[1]
 			raise TDiary::PermissionError.new('invalid plugin name') unless @plugin_name
 			@plugin_name
 		end

data/lib/tdiary/cgi_adapter.rb

@@ -1,4 +1,5 @@
 require 'stringio'
+require 'tdiary/rack/error_handler'
 
 module TDiary
 	#
@@ -23,9 +24,10 @@ module TDiary
 
 			def run( request, dispatcher )
 				env = build_env( request.env.to_hash, request.in, request.err )
-				write_response( request.out, *dispatcher.call( env ) )
+				app = TDiary::Rack::ErrorHandler.new( dispatcher )
+				write_response( request.out, *app.call( env ) )
 			rescue Exception => e
-				write_error( request.out, e )
+				write_error( request, e )
 			ensure
 				request.finish
 			end
@@ -69,9 +71,9 @@ module TDiary
 				end
 			end
 
-			def write_error( out, e )
-				body = "<h1>500 Internal Server Error</h1>\n<pre>#{CGI::escapeHTML( "#{e} (#{e.class})\n\n#{e.backtrace.join( "\n" )}" )}</pre>\n"
-				write_response( out, 500, { 'content-type' => 'text/html' }, [body] )
+			def write_error( request, e )
+				TDiary::Rack::ErrorHandler.report( request.err, e )
+				write_response( request.out, 500, { 'content-type' => 'text/plain' }, ["500 Internal Server Error\n"] )
 			end
 		end
 	end

data/lib/tdiary/cgi_compat.rb

@@ -16,37 +16,51 @@ module TDiary
 			# built eagerly so that a clone (Object#clone copies instance
 			# variables by reference) shares the same params Hash, like a
 			# cloned CGI instance does. Plugins may still rely on this.
-			@params = build_params
+			@params = request.cgi_params
 		end
 
 		attr_reader :params
 
-		def valid?( param, idx = 0 )
-			params[param] and params[param][idx] and params[param][idx].length > 0
+		# the env of the wrapped request, for the stateless RequestExtension
+		# readers (remote_addr, https?, tdiary_base_url, ...)
+		def env
+			@request.env
+		end
+
+		# the stateful RequestExtension readers delegate to the wrapped
+		# request, so core code reading the request directly sees the same
+		# params Hash and the same hidden-referer state as plugins do
+		# through this facade
+		def cgi_params
+			@request.cgi_params
+		end
+
+		def cgi_cookies
+			@request.cgi_cookies
+		end
+
+		def hide_referer!
+			@request.hide_referer!
+		end
+
+		def referer
+			@request.referer
 		end
 
 		def cookies
 			# CGI::Cookie keeps the multi-value cookie behaviour (00default.rb
 			# reads name and mail from the two values of the tdiary cookie)
-			@cookies ||= CGI::Cookie.parse( env_table['HTTP_COOKIE'] )
+			cgi_cookies
 		end
 
 		def env_table
 			@request.env
 		end
 
-		def referer
-			env_table['HTTP_REFERER']
-		end
-
 		def user_agent
 			env_table['HTTP_USER_AGENT']
 		end
 
-		def remote_addr
-			env_table['REMOTE_ADDR']
-		end
-
 		def request_method
 			env_table['REQUEST_METHOD']
 		end
@@ -55,10 +69,6 @@ module TDiary
 			env_table['SCRIPT_NAME']
 		end
 
-		def remote_user
-			env_table['REMOTE_USER']
-		end
-
 		def auth_type
 			env_table['AUTH_TYPE']
 		end
@@ -77,12 +87,6 @@ module TDiary
 
 		# the URL helpers below come from the CGI patches that used to live
 		# in core_ext.rb
-		def https?
-			return true if env_table['HTTP_X_FORWARDED_PROTO'] == 'https'
-			return false if env_table['HTTPS'].nil? or /off/i =~ env_table['HTTPS'] or env_table['HTTPS'] == ''
-			true
-		end
-
 		def request_uri
 			_request_uri = env_table['REQUEST_URI']
 			_script_name = env_table['SCRIPT_NAME']
@@ -103,79 +107,7 @@ module TDiary
 		end
 
 		def base_url
-			return '' unless script_name
-			begin
-				script_dirname = script_name.empty? ? '' : File::dirname(script_name)
-				if https?
-					port = (server_port == 443) ? '' : ':' + server_port.to_s
-					"https://#{server_name}#{port}#{script_dirname}/"
-				else
-					port = (server_port == 80) ? '' : ':' + server_port.to_s
-					"http://#{server_name}#{port}#{script_dirname}/"
-				end.sub(%r|/+$|, '/')
-			rescue SecurityError
-				''
-			end
-		end
-
-	private
-
-		def build_params
-			source =
-				if request_method == 'POST'
-					if %r|\Amultipart/form-data|.match?( env_table['CONTENT_TYPE'].to_s )
-						@request.POST
-					else
-						# Rack's nested query parser behind request.POST keeps only
-						# the last of duplicated keys; CGI collects all of them
-						::Rack::Utils.parse_query( read_raw_body )
-					end
-				else
-					::Rack::Utils.parse_query( env_table['QUERY_STRING'].to_s )
-				end
-
-			params = {}
-			source.each do |key, value|
-				values = value.kind_of?( Array ) ? value : [value]
-				params[key] = values.map {|v| normalize_value( v ) }
-			end
-			params.default = []
-			params
-		end
-
-		def read_raw_body
-			input = env_table['rack.input']
-			return '' unless input
-			# Rack::Request#POST leaves rack.input at EOF, so rewind first in
-			# case the request params were already parsed
-			input.rewind if input.respond_to?( :rewind )
-			body = input.read
-			input.rewind if input.respond_to?( :rewind )
-			body || ''
-		end
-
-		def normalize_value( value )
-			if value.kind_of?( Hash ) and value[:tempfile]
-				# Rack multipart file upload: expose an object responding to
-				# read, which is all the consumers use
-				value[:tempfile]
-			else
-				repair_encoding( value.to_s )
-			end
-		end
-
-		# CGI/FCGI hosting retries broken UTF-8 input as Shift_JIS (index.rb,
-		# misc/lib/fcgi_patch.rb). The facade implements the same fallback on
-		# each value: invalid UTF-8 is converted from Shift_JIS when possible,
-		# otherwise scrubbed.
-		def repair_encoding( str )
-			str = str.dup.force_encoding( Encoding::UTF_8 ) unless str.encoding == Encoding::UTF_8
-			return str if str.valid_encoding?
-			begin
-				str.dup.force_encoding( Encoding::Shift_JIS ).encode( Encoding::UTF_8 )
-			rescue EncodingError
-				str.scrub
-			end
+			tdiary_base_url
 		end
 	end
 end

data/lib/tdiary/configuration.rb

@@ -87,6 +87,7 @@ module TDiary
 				:tdiary_version,
 				:html_title, :author_name, :author_mail, :index_page, :hour_offset,
 				:description, :icon, :banner, :x_frame_options,
+				:referrer_policy, :hsts,
 				:header, :footer,
 				:section_anchor, :comment_anchor, :date_format, :latest_limit, :show_nyear,
 				:theme, :css,
@@ -155,6 +156,9 @@ module TDiary
 
 			@html_title = '' unless @html_title
 			@x_frame_options = nil unless @x_frame_options
+			@referrer_policy = 'strict-origin-when-cross-origin' unless @referrer_policy
+			@hsts = nil unless @hsts
+			@hsts = 'max-age=31536000' if @hsts == true
 			@header = '' unless @header
 			@footer = '' unless @footer