use safe markdown for comments to prevent xss

[iankelling.org] / b.rb

diff --git a/b.rb b/b.rb
index 511ac8d9717c4d535a0a929ca5fffab82a46d88e..b5e2aa91bb94782a20a18316717492f4d92cc626 100644 (file)
--- a/b.rb
+++ b/b.rb
@@ -49,6 +49,7 @@ module B # blog module
   end
 
   def fwrite(output_path, string)
+    output_path = File.join('./', output_path)
     FileUtils.mkdir_p(File.dirname(output_path))
     File.write(output_path, string)
   end
@@ -57,7 +58,7 @@ module B # blog module
     head = <<EOF
 <link rel="canonical" href="#{DURL}/#{rel_path}">
 EOF
-    if rel_path =~ %r{^blog/.}
+    if rel_path =~ %r{^/blog/|^blog.html}
       head += <<EOF
 <link rel="alternate" type="application/atom+xml" title="#{DN}" href="#{DURL}/feed.xml">
 EOF
@@ -95,8 +96,8 @@ EOF
     </div>
     <footer>
 #{o[:footer]}
-      <p>This site has a <a href="/git/?p=iankelling.org;a=summary">git repo</a>. Code is gpl, content is <a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/"><img id="cc-by-sa" alt="Creative Commons License" src="/assets/cc-by-sa-4.0-80x15.png" /></a> unless otherwise noted</p>
-      <p><address><a href="ian@iankelling.org">ian@iankelling.org</a> let me know what you think</address></p>
+      <p>This site has a <a href="/git/?p=iankelling.org;a=summary">git repo</a>. Unless stated otherwise, <a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/"><img id="cc-by-sa" alt="Creative Commons License" src="/assets/cc-by-sa-4.0-80x15.png" /></a></p>
+      <p><address><a href="mailto:ian@iankelling.org">ian@iankelling.org</a> let me know what you think</address></p>
     </footer>
   </body>
 </html>
@@ -125,7 +126,7 @@ EOF
   end
 
   def comment_html(comment, date)
-    inner = Redcarpet::Markdown.new(Redcarpet::Render::HTML, fenced_code_blocks: true).render(<<EOF)
+    inner = Redcarpet::Markdown.new(Redcarpet::Render::Safe, fenced_code_blocks: true).render(<<EOF)
 #{comment}
 <span class="comment-date">#{Time.at(date).strftime("%b %-d '%y")}</span>
 EOF
@@ -161,11 +162,11 @@ EOF
     b = File.basename(file,'.md')
     # date is in the format: YYYY-MM-DD-
     date = Time.parse(b[0..DATE_LEN])
-    rel_path = "blog/#{b[(DATE_LEN + 1)..-1]}.html"
+    rel_path = "/blog/#{b[(DATE_LEN + 1)..-1]}.html"
     comments = $db.execute <<-SQL, [WAIT_DATE]
       select comment, date from c
       where page = '#{rel_path}' and (
-       state = 'picked' or state = 'known'
+       state = 'picked' or state = 'known' or state = 'timed'
        or (state = 'waiting' and date < ?))
 SQL
     # get earliest comment. earlier ones stored in git will also be
@@ -221,7 +222,7 @@ EOF
         comment_html("Note: there #{text} pending approval.", NOW)
     end
     com_section = <<-EOF
-      <form class="comment" action="/comment.rb" method="post">
+      <form class="comment" action="/cgi/comment" method="post">
         <input class="misc" type="text" name="url">
         <input name="goto" type="hidden" value="#{rel_path}">
         <textarea rows="10" name="comment" placeholder="markdown" maxlength="1000"></textarea>
@@ -270,7 +271,7 @@ EOF
           footer: footer_extra,
           comments: com_section,
           description: description)
-    url="#{DURL}/#{rel_path}"
+    url="#{DURL}#{rel_path}"
 
 
     # following from https://creativecommons.org/choose,