view: escape HTML description name

[public-inbox.git] / lib / PublicInbox / View.pm

diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm
index 97a8bcbc50719a2691b2297ceee8f9e7cbad4105..9ef4712f313cc0bf59f21cbbf38fcbb8beeb0bac 100644 (file)
--- a/lib/PublicInbox/View.pm
+++ b/lib/PublicInbox/View.pm
@@ -92,13 +92,13 @@ EOF
 
 sub in_reply_to {
        my ($hdr) = @_;
-       my $irt = $hdr->header_raw('In-Reply-To');
-
-       return mid_clean($irt) if defined $irt && $irt ne '';
-
-       my $refs = $hdr->header_raw('References');
-       if ($refs && $refs =~ /<([^>]+)>\s*\z/s) {
-               return $1;
+       my %mid = map { $_ => 1 } $hdr->header_raw('Message-ID');
+       my @refs = ($hdr->header_raw('References'),
+                       $hdr->header_raw('In-Reply-To'));
+       @refs = ((join(' ', @refs)) =~ /<([^>]+)>/g);
+       while (defined(my $irt = pop @refs)) {
+               next if $mid{"<$irt>"};
+               return $irt;
        }
        undef;
 }
@@ -201,7 +201,10 @@ sub _th_index_lite {
        my $rv = '';
        my $mapping = $ctx->{mapping} or return $rv;
        my $pad = '  ';
-       my ($attr, $node, $idx, $level) = @{$mapping->{$mid_raw}};
+       my $mid_map = $mapping->{$mid_raw};
+       defined $mid_map or
+               return 'public-inbox BUG: '.ascii_html($mid_raw).' not mapped';
+       my ($attr, $node, $idx, $level) = @$mid_map;
        my $children = $node->{children};
        my $nr_c = scalar @$children;
        my $nr_s = 0;
@@ -299,7 +302,7 @@ sub stream_thread ($$) {
        }
        return missing_thread($ctx) unless $mime;
 
-       $mime = Email::MIME->new($mime);
+       $mime = PublicInbox::MIME->new($mime);
        $ctx->{-title_html} = ascii_html($mime->header('Subject'));
        $ctx->{-html_tip} = thread_index_entry($ctx, $level, $mime);
        PublicInbox::WwwStream->response($ctx, 200, sub {
@@ -311,7 +314,7 @@ sub stream_thread ($$) {
                        unshift @q, map { ($cl, $_) } @{$node->{children}};
                        my $mid = $node->{id};
                        if ($mime = $inbox->msg_by_smsg($node->{smsg})) {
-                               $mime = Email::MIME->new($mime);
+                               $mime = PublicInbox::MIME->new($mime);
                                return thread_index_entry($ctx, $level, $mime);
                        } else {
                                return ghost_index_entry($ctx, $level, $node);
@@ -362,7 +365,7 @@ sub thread_html {
                $mime = $inbox->msg_by_smsg($mime) and last;
        }
        return missing_thread($ctx) unless $mime;
-       $mime = Email::MIME->new($mime);
+       $mime = PublicInbox::MIME->new($mime);
        $ctx->{-title_html} = ascii_html($mime->header('Subject'));
        $ctx->{-html_tip} = '<pre>'.index_entry($mime, $ctx, scalar @$msgs);
        $mime = undef;
@@ -372,7 +375,7 @@ sub thread_html {
                        $mime = $inbox->msg_by_smsg($mime) and last;
                }
                if ($mime) {
-                       $mime = Email::MIME->new($mime);
+                       $mime = PublicInbox::MIME->new($mime);
                        return index_entry($mime, $ctx, scalar @$msgs);
                }
                $msgs = undef;
@@ -435,6 +438,7 @@ sub attach_link ($$$$;$) {
        }
        $ret .= "[-- Attachment #$idx: ";
        my $ts = "Type: $ct, Size: $size bytes";
+       $desc = ascii_html($desc);
        $ret .= ($desc eq '') ? "$ts --]" : "$desc --]\n[-- $ts --]";
        $ret .= "</a>\n";
 }
@@ -476,15 +480,14 @@ sub add_text_body {
        }
        my @quot;
        my $l = PublicInbox::Linkify->new;
-       while (defined(my $cur = shift @lines)) {
+       foreach my $cur (@lines) {
                if ($cur !~ /^>/) {
                        # show the previously buffered quote inline
                        flush_quote(\$s, $l, \@quot) if @quot;
 
                        # regular line, OK
-                       $cur = $l->linkify_1($cur);
-                       $cur = ascii_html($cur);
-                       $s .= $l->linkify_2($cur);
+                       $l->linkify_1($cur);
+                       $s .= $l->linkify_2(ascii_html($cur));
                } else {
                        push @quot, $cur;
                }