Merge pull request #1844 from metacpan/haarg/pod-filtering

pod filtering
metacpan · Jan 12, 2017 · 8878b30 · 8878b30
2 parents 1014b17 + 70103ca
commit 8878b30
Show file tree

Hide file tree

Showing 3 changed files with 59 additions and 25 deletions.
diff --git a/lib/MetaCPAN/Web/Controller/Pod.pm b/lib/MetaCPAN/Web/Controller/Pod.pm
@@ -3,6 +3,8 @@ package MetaCPAN::Web::Controller::Pod;
 use HTML::Restrict;
 use Moose;
 use Try::Tiny;
+use URI;
+use HTML::Escape qw(escape_html);
 
 use namespace::autoclean;
 
@@ -120,20 +122,19 @@ sub view : Private {
     $self->stash_api_results( $c, $reqs, $data );
     $self->add_favorites_data( $data, $reqs->{favorites}, $data );
 
-    my $hr = HTML::Restrict->new;
-    $hr->set_uri_schemes(
-        [ undef, 'http', 'https', 'data', 'mailto', 'irc', 'ircs' ] );
-    $hr->set_rules(
-        {
+    my $hr = HTML::Restrict->new(
+        uri_schemes =>
+            [ undef, 'http', 'https', 'data', 'mailto', 'irc', 'ircs' ],
+        rules => {
             a       => [qw( href id target )],
             b       => [],
             br      => [],
             caption => [],
             center  => [],
             code    => [ { class => qr/^language-\S+$/ } ],
-            dd      => ['id'],
-            div     => [qw(id style)],
-            dl      => ['id'],
+            dd      => [],
+            div     => [ { class => qr/^pod-errors(?:-detail)?$/ } ],
+            dl      => [],
             dt      => ['id'],
             em      => [],
             h1      => ['id'],
@@ -143,29 +144,62 @@ sub view : Private {
             h5      => ['id'],
             h6      => ['id'],
             i       => [],
-            img     => [qw( alt border height width src style title / )],
             li      => ['id'],
             ol      => [],
-            p       => [qw(style)],
+            p       => [],
             pre     => [
-                qw(id style),
                 {
                     class        => qr/^line-numbers$/,
                     'data-line'  => qr/^\d+(?:-\d+)?(?:,\d+(?:-\d+)?)*$/,
                     'data-start' => qr/^\d+$/,
                 }
             ],
-            span   => [qw(style)],
+            span   => [ { style => qr/^white-space: nowrap;$/ } ],
             strong => [],
             sub    => [],
             sup    => [],
-            table  => [qw( style border cellspacing cellpadding align )],
-            tbody  => [],
-            td     => [qw(style)],
-            tr     => [qw(style)],
-            u      => [],
-            ul     => ['id'],
-        }
+            table => [ qw( border cellspacing cellpadding align ), ],
+            tbody => [],
+            th    => [],
+            td    => [],
+            tr    => [],
+            u     => [],
+            ul    => [ { id => qr/^index$/ } ],
+        },
+        replace_img => sub {
+            my ( $tagname, $attrs, $text ) = @_;
+            my $tag = '<img';
+            for my $attr (qw( alt border height width src title)) {
+                next
+                    unless exists $attrs->{$attr};
+                my $val = $attrs->{$attr};
+                if ( $attr eq 'src' ) {
+                    if ( $val =~ m{^(?:(?:https?|ftp|data):)?//} ) {
+
+                        # use directly
+                    }
+                    elsif ( $val =~ /^[0-9a-zA-Z.+-]+:/ ) {
+
+                        # bad protocol
+                        return '';
+                    }
+                    else {
+                        my $base = "https://st.aticpan.org/source/";
+                        if ( $val =~ s{^/}{} ) {
+                            $base .= "$data->{author}/$data->{release}/";
+                        }
+                        else {
+                            $base .= $pod
+                                || "$data->{author}/$data->{release}/$data->{path}";
+                        }
+                        $val = URI->new_abs( $val, $base )->as_string;
+                    }
+                }
+                $tag .= qq{ $attr="} . escape_html($val) . qq{"};
+            }
+            $tag .= ' />';
+            return $tag;
+        },
     );
 
     my $release = $reqs->{release}->{hits}->{hits}->[0]->{_source};

diff --git a/root/static/js/cpan.js b/root/static/js/cpan.js
@@ -271,7 +271,7 @@ $(document).ready(function() {
 
     var module_source_href = $('#source-link').attr('href');
     if (module_source_href) {
-        $('#pod-error-detail dt').each(function() {
+        $('.pod-errors-detail dt').each(function() {
             var $dt = $(this);
             var link_text = $dt.text();
             var capture = link_text.match(/Around line (\d+)/);
@@ -281,8 +281,8 @@ $(document).ready(function() {
             );
         });
     }
-    $('#pod-errors').addClass('collapsed');
-    $('#pod-errors > p:first-child').click(function() {
+    $('.pod-errors').addClass('collapsed');
+    $('.pod-errors > p:first-child').click(function() {
         $(this).parent().toggleClass('collapsed');
     });
 

diff --git a/root/static/less/pod.less b/root/static/less/pod.less
@@ -142,7 +142,7 @@ ul#index, #index ul {
     padding-left: 16px;
 }
 
-#pod-errors {
+.pod-errors {
     margin: 3em 0 0 0 ;
     padding: 10px;
     background-color: #ffffee;
@@ -158,15 +158,15 @@ ul#index, #index ul {
         cursor: pointer;
     }
 
-    #pod-error-detail {
+    .pod-errors-detail {
         margin-top: 5px;
     }
 
     &.collapsed {
         border-color: transparent;
         background-color: transparent;
 
-        #pod-error-detail {
+        .pod-errors-detail {
             display: none;
         }
     }