tdiary 5.5.1 → 5.6.0

data/lib/tdiary/core_ext.rb

@@ -1,6 +1,9 @@
 require 'emot'
 
 module TDiary
+	# CGI-semantics readers shared by TDiary::Request and the CGICompat
+	# facade (which forwards env to the request it wraps, so state memoized
+	# in the env is visible through either object).
 	module RequestExtension
 		# backward compatibility, returns NOT mobile phone always
 		def mobile_agent?
@@ -11,6 +14,147 @@ module TDiary
 		def smartphone?
 			false
 		end
+
+		# true when the endpoint runs behind a web server (CGI/FCGI hosting,
+		# which sets tdiary.static_assets in the env) that serves the js/ and
+		# theme/ directories itself; false on the Rack path, where
+		# TDiary::Application serves them under assets/
+		def static_assets?
+			env['tdiary.static_assets'] ? true : false
+		end
+
+		# params with CGI semantics, unlike Rack::Request#params: POST reads
+		# only the body, every value is an Array, unknown keys yield [],
+		# duplicated keys collect all values, broken UTF-8 input is retried
+		# as Shift_JIS and multipart uploads are normalized to their
+		# tempfiles. Memoized so the request and its CGICompat facade (which
+		# delegates here) share one Hash; plugins mutate it through
+		# @cgi.params.
+		def cgi_params
+			@cgi_params ||= build_cgi_params
+		end
+
+		# single-value accessor over cgi_params; nil when the key is absent
+		def param( key, idx = 0 )
+			cgi_params[key][idx]
+		end
+
+		def valid?( param, idx = 0 )
+			cgi_params[param] and cgi_params[param][idx] and cgi_params[param][idx].length > 0
+		end
+
+		# multi-value cookies, unlike Rack::Request#cookies: CGI::Cookie
+		# splits each value on '&' (the tdiary cookie carries 'name&mail')
+		def cgi_cookies
+			@cgi_cookies ||= CGI::Cookie.parse( env['HTTP_COOKIE'] )
+		end
+
+		# TDiaryView hides the referer for the rest of the request when the
+		# referer filters reject it; plugins observe nil through the @cgi
+		# facade too, which delegates both methods to the request
+		def hide_referer!
+			@referer_hidden = true
+		end
+
+		def referer
+			@referer_hidden ? nil : env['HTTP_REFERER']
+		end
+
+		def remote_addr
+			env['REMOTE_ADDR']
+		end
+
+		def remote_user
+			env['REMOTE_USER']
+		end
+
+		def https?
+			return true if env['HTTP_X_FORWARDED_PROTO'] == 'https'
+			return false if env['HTTPS'].nil? or /off/i =~ env['HTTPS'] or env['HTTPS'] == ''
+			true
+		end
+
+		# not Rack::Request#base_url (scheme and host only): the CGI flavour
+		# with the SCRIPT_NAME dirname and a trailing '/'
+		def tdiary_base_url
+			script_name = env['SCRIPT_NAME']
+			return '' unless script_name
+			begin
+				script_dirname = script_name.empty? ? '' : File::dirname( script_name )
+				server_name = env['SERVER_NAME']
+				server_port = env['SERVER_PORT'].to_i
+				if https?
+					port = (server_port == 443) ? '' : ':' + server_port.to_s
+					"https://#{server_name}#{port}#{script_dirname}/"
+				else
+					port = (server_port == 80) ? '' : ':' + server_port.to_s
+					"http://#{server_name}#{port}#{script_dirname}/"
+				end.sub(%r|/+$|, '/')
+			rescue SecurityError
+				''
+			end
+		end
+
+	private
+
+		def build_cgi_params
+			source =
+				if env['REQUEST_METHOD'] == 'POST'
+					if %r|\Amultipart/form-data|.match?( env['CONTENT_TYPE'].to_s )
+						self.POST
+					else
+						# Rack's nested query parser behind Rack::Request#POST keeps
+						# only the last of duplicated keys; CGI collects all of them.
+						# CGI also splits on ';' as well as '&', and tDiary's own edit
+						# links (00default.rb, edit_today.rb) still use ';'
+						::Rack::Utils.parse_query( read_raw_body, '&;' )
+					end
+				else
+					::Rack::Utils.parse_query( env['QUERY_STRING'].to_s, '&;' )
+				end
+
+			params = {}
+			source.each do |key, value|
+				values = value.kind_of?( Array ) ? value : [value]
+				params[key] = values.map {|v| normalize_cgi_value( v ) }
+			end
+			params.default = []
+			params
+		end
+
+		def read_raw_body
+			input = env['rack.input']
+			return '' unless input
+			# Rack::Request#POST leaves rack.input at EOF, so rewind first in
+			# case the request params were already parsed
+			input.rewind if input.respond_to?( :rewind )
+			body = input.read
+			input.rewind if input.respond_to?( :rewind )
+			body || ''
+		end
+
+		def normalize_cgi_value( value )
+			if value.kind_of?( Hash ) and value[:tempfile]
+				# Rack multipart file upload: expose an object responding to
+				# read, which is all the consumers use
+				value[:tempfile]
+			else
+				repair_encoding( value.to_s )
+			end
+		end
+
+		# CGI/FCGI hosting retries broken UTF-8 input as Shift_JIS. The same
+		# fallback is applied to each value: invalid UTF-8 is converted from
+		# Shift_JIS when possible, otherwise scrubbed.
+		def repair_encoding( str )
+			str = str.dup.force_encoding( Encoding::UTF_8 ) unless str.encoding == Encoding::UTF_8
+			return str if str.valid_encoding?
+			begin
+				str.dup.force_encoding( Encoding::Shift_JIS ).encode( Encoding::UTF_8 )
+			rescue EncodingError
+				str.scrub
+			end
+		end
 	end
 end
 
@@ -54,7 +198,8 @@ end
 require 'tdiary/cgi_compat'
 
 # the @cgi facade for Rack-hosted requests. Kept as a toplevel constant
-# because plugins switch behaviour with @cgi.is_a?(RackCGI).
+# only for third-party plugins that switch behaviour with
+# @cgi.is_a?(RackCGI); in-repo code reads static_assets? instead.
 class RackCGI < TDiary::CGICompat; end
 
 # Local Variables:

data/lib/tdiary/dispatcher/index_main.rb

@@ -16,20 +16,18 @@ module TDiary
 
 			def run
 				begin
-					status = nil
 					@tdiary = create_tdiary
 
 					begin
+						status = 200
 						head = {
 							'content-type' => 'text/html; charset=UTF-8',
 							'vary' => 'User-Agent'
 						}
-						head['status'] = status if status
 						body = ''
-						head['Last-Modified'] = CGI::rfc1123_date( tdiary.last_modified )
+						head['last-modified'] = tdiary.last_modified.httpdate
 
 						if request.head?
-							head['pragma'] = 'no-cache'
 							head['cache-control'] = 'no-cache'
 							return TDiary::Response.new( '', 200, head )
 						else
@@ -37,15 +35,12 @@ module TDiary
 							body = tdiary.eval_rhtml
 							head['etag'] = %Q["#{OpenSSL::Digest::SHA256.hexdigest( body )}"]
 							if request.env['HTTP_IF_NONE_MATCH'] == head['etag'] and request.get? then
-								head['status'] = CGI::HTTP_STATUS['NOT_MODIFIED']
+								status = 304
 							else
-								head['charset'] = conf.encoding
 								head['content-length'] = body.bytesize.to_s
 							end
-							head['pragma'] = 'no-cache'
 							head['cache-control'] = 'no-cache'
-							head['x-frame-options'] = conf.x_frame_options if conf.x_frame_options
-							res = TDiary::Response.new( body, ::TDiary::Dispatcher.extract_status_for_legacy_tdiary( head ), head )
+							res = TDiary::Response.new( body, status, head )
 							res.set_header('Set-Cookie', tdiary.cookies.map(&:to_s)) if tdiary && tdiary.cookies.size > 0
 							res
 						end
@@ -56,20 +51,7 @@ module TDiary
 						TDiary::Response.new( body, 404, { 'content-type' => 'text/html' } )
 					end
 				rescue TDiary::ForceRedirect
-					head = {
-						#'Location' => $!.path
-						'content-type' => 'text/html',
-					}
-					body = %Q[
-								<html>
-								<head>
-								<meta http-equiv="refresh" content="1;url=#{$!.path}">
-								<title>moving...</title>
-								</head>
-								<body>Wait or <a href="#{$!.path}">Click here!</a></body>
-								</html>]
-					# TODO return code should be 302? (current behaviour returns 200)
-					res = TDiary::Response.new( body, 200, head )
+					res = TDiary::Response.new( '', 303, { 'location' => $!.path } )
 					res.set_header('Set-Cookie', tdiary.cookies.map(&:to_s)) if tdiary && tdiary.cookies.size > 0
 					res
 				end

data/lib/tdiary/dispatcher/update_main.rb

@@ -21,28 +21,13 @@ module TDiary
 					body = tdiary.eval_rhtml
 					head = {
 						'content-type' => 'text/html; charset=UTF-8',
-						'charset' => conf.encoding,
 						'content-length' => body.bytesize.to_s,
-						'vary' => 'User-Agent',
-						'x-frame-options' => 'SAMEORIGIN'
+						'vary' => 'User-Agent'
 					}
 					body = ( request.head? ? '' : body )
 					TDiary::Response.new( body, 200, head )
 				rescue TDiary::ForceRedirect
-					head = {
-						#'Location' => $!.path
-						'content-type' => 'text/html',
-					}
-					body = %Q[
-								<html>
-								<head>
-								<meta http-equiv="refresh" content="1;url=#{$!.path}">
-								<title>moving...</title>
-								</head>
-								<body>Wait or <a href="#{$!.path}">Click here!</a></body>
-								</html>]
-					# TODO return code should be 302? (current behaviour returns 200)
-					res = TDiary::Response.new( body, 200, head )
+					res = TDiary::Response.new( '', 303, { 'location' => $!.path } )
 					res.set_header('Set-Cookie', tdiary.cookies.map(&:to_s)) if tdiary && tdiary.cookies.size > 0
 					res
 				end

data/lib/tdiary/dispatcher.rb

@@ -17,24 +17,13 @@ module TDiary
 
 		def call( env )
 			request = adopt_rack_request_to_plain_old_tdiary_style( env )
-			result = @target.run( request )
-			result.headers.reject!{|k,v| k.to_s.downcase == "status" }
-			result.to_a
+			main = @target.new( request )
+			response = main.run
+			apply_security_headers( response, request, main.conf )
+			response.to_a
 		end
 
 		class << self
-			# FIXME temporary method during (scratch) refactoring
-			def extract_status_for_legacy_tdiary( head )
-				status_str = head.delete('status')
-				return 200 if !status_str || status_str.empty?
-
-				if m = status_str.match(/(\d+)\s(.+)\Z/)
-					m[1].to_i
-				else
-					200
-				end
-			end
-
 			def index
 				new( :index )
 			end
@@ -48,6 +37,31 @@ module TDiary
 
 	private
 
+		def apply_security_headers( response, request, conf )
+			response.set_header( 'x-content-type-options', 'nosniff' )
+			apply_frame_restrictions( response, conf )
+			response.set_header( 'referrer-policy', conf.referrer_policy ) if conf.referrer_policy
+			response.set_header( 'strict-transport-security', conf.hsts ) if conf.hsts && request.ssl?
+		end
+
+		# The update target is an authenticated admin UI and always forbids
+		# cross-origin framing; the index target follows conf.x_frame_options.
+		# CSP frame-ancestors is the standard control, X-Frame-Options is kept
+		# alongside for legacy user agents.
+		def apply_frame_restrictions( response, conf )
+			if @target == UpdateMain
+				response.set_header( 'content-security-policy', "frame-ancestors 'self'" )
+				response.set_header( 'x-frame-options', 'SAMEORIGIN' )
+			elsif conf.x_frame_options
+				ancestors = case conf.x_frame_options.upcase
+								when 'SAMEORIGIN' then "'self'"
+								when 'DENY' then "'none'"
+								end
+				response.set_header( 'content-security-policy', "frame-ancestors #{ancestors}" ) if ancestors
+				response.set_header( 'x-frame-options', conf.x_frame_options )
+			end
+		end
+
 		def adopt_rack_request_to_plain_old_tdiary_style( env )
 			# rebuffer rack.input into a rewindable StringIO; both
 			# Rack::Request and CGICompat read the body from it

data/lib/tdiary/filter/default.rb

@@ -9,7 +9,7 @@ module TDiary
 	module Filter
 		class DefaultFilter < Filter
 			def comment_filter( diary, comment )
-				if 'POST' != @cgi.request_method then
+				if 'POST' != @request.request_method then
 					return false
 				end
 				if comment.name.strip.empty? or comment.body.strip.empty? then
@@ -29,7 +29,7 @@ module TDiary
 					false
 				#elsif /[\x00-\x20\x7f-\xff]/ =~ referer then
 				#	false
-				elsif @conf.bot =~ @cgi.user_agent
+				elsif @conf.bot =~ @request.user_agent
 					false
 				elsif %r|^https?://|i =~ referer
 					ref = CGI::unescape( referer.sub( /#.*$/, '' ).sub( /\?\d{8}$/, '' ) ).force_encoding('ASCII-8BIT')

data/lib/tdiary/filter/spam.rb

@@ -228,8 +228,8 @@ module TDiary
 					return @filter_mode
 				end
 
-				if @bad_ips.detect {|p| p =~ @cgi.remote_addr}
-					debug( "ip address blacklisted: /#{p}/ =~ #{@cgi.remote_addr}" )
+				if @bad_ips.detect {|p| p =~ @request.remote_addr}
+					debug( "ip address blacklisted: /#{p}/ =~ #{@request.remote_addr}" )
 					comment.show = false
 					return @filter_mode
 				end

data/lib/tdiary/filter.rb

@@ -35,7 +35,7 @@ module TDiary
 				return if @debug_mode == DEBUG_NONE
 				return if @debug_mode == DEBUG_SPAM and level == DEBUG_FULL
 
-				TDiary.logger.info("#{@cgi.remote_addr}->#{(@cgi.params['date'][0] || 'no date').dump}: #{msg}")
+				TDiary.logger.info("#{@request.remote_addr}->#{(@request.param('date') || 'no date').dump}: #{msg}")
 			end
 		end
 	end

data/lib/tdiary/plugin/00default.rb

@@ -372,8 +372,18 @@ def script_tag_query_string
 	"?#{TDIARY_VERSION}#{Time::now.strftime('%Y%m%d')}"
 end
 
+# base URL the static assets are served from, when specified in
+# tdiary.conf: @options['assets_url'] = 'https://assets.example.org/tdiary'
+# It expects the merged layout the Rack assets/ mount serves (js files and
+# theme directories under one root) and wins over the hosting default on
+# every path (Rack, CGI and FCGI).
+def configured_assets_url
+	url = @conf['assets_url']
+	url && !url.empty? ? url.chomp('/') : nil
+end
+
 def js_url
-	@cgi.is_a?(RackCGI) ? 'assets' : 'js'
+	configured_assets_url || (@cgi.static_assets? ? 'js' : 'assets')
 end
 
 def script_tag
@@ -396,7 +406,7 @@ def script_tag
 end
 
 def theme_url
-	@cgi.is_a?(RackCGI) ? 'assets' : 'theme'
+	configured_assets_url || (@cgi.static_assets? ? 'theme' : 'assets')
 end
 
 def css_tag
@@ -748,6 +758,10 @@ def saveconf_default
 		@conf['base_url'] = @cgi.params['base_url'][0]
 		@conf.x_frame_options = @cgi.params['x_frame_options'][0]
 		@conf.x_frame_options = nil if @conf.x_frame_options.empty?
+		@conf.referrer_policy = @cgi.params['referrer_policy'][0]
+		@conf.referrer_policy = nil if @conf.referrer_policy.empty?
+		@conf.hsts = @cgi.params['hsts'][0]
+		@conf.hsts = nil if @conf.hsts.empty?
 	end
 end
 
@@ -887,7 +901,8 @@ def saveconf_csrf_protection
 			if (check_method & 2 == 2 &&
 			    (old_method & 2 == 0 || old_key != check_key))
 				@conf.save
-				raise ForceRedirect, "#{h @conf.update}?conf=csrf_protection#{@cgi.referer ? '&referer_exists=true' : ''}"
+				# the path is sent as a Location header now, so no HTML escaping
+				raise ForceRedirect, "#{@conf.update}?conf=csrf_protection#{@cgi.referer ? '&referer_exists=true' : ''}"
 			end
 		end
 		err

data/lib/tdiary/plugin/en/00default.rb

@@ -169,6 +169,21 @@ add_conf_proc( 'default', 'Site information', 'basic' ) do
 		<option value="SAMEORIGIN"#{" selected" if @conf.x_frame_options == 'SAMEORIGIN'}>Permit in same domain</option>
 		<option value="DENY"#{" selected" if @conf.x_frame_options == 'DENY'}>Deny</option>
 	</select></p>
+
+	<h3 class="subtitle">Referrer Policy</h3>
+	<p>Controls how much referrer information the browser sends when following links from your diary to other sites. The default matches the browser's standard behavior.</p>
+	<p><select name="referrer_policy">
+		<option value="strict-origin-when-cross-origin"#{" selected" if @conf.referrer_policy == 'strict-origin-when-cross-origin'}>Send origin only to other sites (default)</option>
+		<option value="same-origin"#{" selected" if @conf.referrer_policy == 'same-origin'}>Do not send to other sites</option>
+		<option value="no-referrer"#{" selected" if @conf.referrer_policy == 'no-referrer'}>Never send</option>
+	</select></p>
+
+	<h3 class="subtitle">Force HTTPS (HSTS)</h3>
+	<p>Sends the Strict-Transport-Security header on HTTPS responses so browsers keep using HTTPS afterwards. Leave disabled if your site is served over HTTP.</p>
+	<p><select name="hsts">
+		<option value=""#{" selected" unless @conf.hsts}>Disabled</option>
+		<option value="max-age=31536000"#{" selected" if @conf.hsts == 'max-age=31536000'}>Enabled (1 year)</option>
+	</select></p>
 	HTML
 end
 

data/lib/tdiary/plugin/ja/00default.rb

@@ -196,6 +196,21 @@ add_conf_proc( 'default', 'サイトの情報', 'basic' ) do
 		<option value="SAMEORIGIN"#{" selected" if @conf.x_frame_options == 'SAMEORIGIN'}>同一ドメインなら許可する</option>
 		<option value="DENY"#{" selected" if @conf.x_frame_options == 'DENY'}>禁止する</option>
 	</select></p>
+
+	<h3 class="subtitle">Referrerポリシー</h3>
+	<p>日記内のリンクをたどって他のサイトへ移動するときに、ブラウザが送信するReferrerの範囲を指定します。標準の設定はブラウザの既定動作と同じです。</p>
+	<p><select name="referrer_policy">
+		<option value="strict-origin-when-cross-origin"#{" selected" if @conf.referrer_policy == 'strict-origin-when-cross-origin'}>他サイトへはURLの先頭部分のみ送信する(標準)</option>
+		<option value="same-origin"#{" selected" if @conf.referrer_policy == 'same-origin'}>他サイトへは送信しない</option>
+		<option value="no-referrer"#{" selected" if @conf.referrer_policy == 'no-referrer'}>常に送信しない</option>
+	</select></p>
+
+	<h3 class="subtitle">HTTPSの強制(HSTS)</h3>
+	<p>HTTPSでアクセスされたときに、以後もHTTPSの使用をブラウザに強制するStrict-Transport-Securityヘッダを送出します。HTTPで運用しているサイトでは無効のままにしてください。</p>
+	<p><select name="hsts">
+		<option value=""#{" selected" unless @conf.hsts}>無効</option>
+		<option value="max-age=31536000"#{" selected" if @conf.hsts == 'max-age=31536000'}>有効(期間1年)</option>
+	</select></p>
 	HTML
 end
 

data/lib/tdiary/plugin.rb

@@ -349,7 +349,7 @@ module TDiary
 		end
 
 		def conf_current_style( key )
-			if key == @cgi.params['conf'][0] then
+			if key == @request.param('conf') then
 				'selected'
 			else
 				'other'

data/lib/tdiary/rack/error_handler.rb

@@ -0,0 +1,36 @@
+module TDiary
+	module Rack
+		#
+		# class ErrorHandler
+		#  catches exceptions leaked from the downstream app, reports the
+		#  class, message and backtrace to rack.errors, and replaces the
+		#  response with a plain 500 that does not expose the details to
+		#  the client.
+		#
+		class ErrorHandler
+			def initialize( app )
+				@app = app
+			end
+
+			def call( env )
+				@app.call( env )
+			rescue Exception => e
+				self.class.report( env['rack.errors'], e )
+				[500, { 'content-type' => 'text/plain' }, ["500 Internal Server Error\n"]]
+			end
+
+			def self.report( errors, e )
+				errors.puts "#{e.class}: #{e.message}"
+				( e.backtrace || [] ).each {|line| errors.puts "\t#{line}" }
+				errors.flush
+			end
+		end
+	end
+end
+
+# Local Variables:
+# mode: ruby
+# indent-tabs-mode: t
+# tab-width: 3
+# ruby-indent-level: 3
+# End:

data/lib/tdiary/rack.rb

@@ -1,5 +1,6 @@
 module TDiary
 	module Rack
+		autoload :ErrorHandler,     'tdiary/rack/error_handler'
 		autoload :HtmlAnchor,       'tdiary/rack/html_anchor'
 		autoload :ValidRequestPath, 'tdiary/rack/valid_request_path'
 		autoload :Session,          'tdiary/rack/session'

data/lib/tdiary/request.rb

@@ -5,8 +5,9 @@ module TDiary
 
 		# the @cgi object handed to plugins: a facade over this request.
 		# Endpoints behind a web server (CGI/FCGI) set tdiary.static_assets in
-		# the env to get the base CGICompat, so @cgi.is_a?(RackCGI) is false and
-		# plugins keep the static js/theme URLs served by the web server.
+		# the env to get the base CGICompat. The RackCGI/CGICompat split only
+		# serves third-party plugins that check @cgi.is_a?(RackCGI); in-repo
+		# code reads the flag through RequestExtension#static_assets?.
 		def cgi_compat
 			@cgi_compat ||=
 				if env['tdiary.static_assets']

data/lib/tdiary/server.rb

@@ -12,6 +12,28 @@ module TDiary
 		require 'webrick/accesslog'
 		require 'tempfile'
 
+		# WEBrick's CGI runner clears the environment of the CGI child process
+		# before exec'ing it, so the child cannot find the gems the server itself
+		# runs with. Hand the RubyGems and Bundler locations back to it.
+		module CGIEnvironment
+			def meta_vars
+				super.merge( {
+					'HOME' => ENV['HOME'],
+					'GEM_HOME' => Gem.dir,
+					'GEM_PATH' => Gem.path.join( File::PATH_SEPARATOR ),
+					'BUNDLE_GEMFILE' => ENV['BUNDLE_GEMFILE'],
+				}.compact )
+			end
+		end
+
+		class CGIHandler < WEBrick::HTTPServlet::CGIHandler
+			def do_GET( req, res )
+				req.extend( CGIEnvironment )
+				super
+			end
+			alias do_POST do_GET
+		end
+
 		class << self
 			def run( option )
 				@@server = new( option )
@@ -38,9 +60,9 @@ module TDiary
 				CGIInterpreter: WEBrick::HTTPServlet::CGIHandler::Ruby
 			)
 			@server.logger.level = WEBrick::Log::DEBUG
-			@server.mount("/", WEBrick::HTTPServlet::CGIHandler, TDiary.root + "/index.rb")
-			@server.mount("/index.rb", WEBrick::HTTPServlet::CGIHandler, TDiary.root + '/index.rb')
-			@server.mount("/update.rb", WEBrick::HTTPServlet::CGIHandler, TDiary.root + "/update.rb")
+			@server.mount("/", CGIHandler, TDiary.root + "/index.rb")
+			@server.mount("/index.rb", CGIHandler, TDiary.root + '/index.rb')
+			@server.mount("/update.rb", CGIHandler, TDiary.root + "/update.rb")
 			@server.mount("/theme", WEBrick::HTTPServlet::FileHandler, TDiary.root + '/theme')
 			@server.mount("/js", WEBrick::HTTPServlet::FileHandler, TDiary.root + '/js')
 		end

data/lib/tdiary/version.rb

@@ -1,3 +1,3 @@
 module TDiary
-	VERSION = "5.5.1"
+	VERSION = "5.6.0"
 end