1 # Copyright (C) 2014-2016 all contributors <meta@public-inbox.org>
2 # License: AGPL-3.0+ <https://www.gnu.org/licenses/agpl-3.0.txt>
4 # two-step linkification.
5 # intended usage is in the following order:
8 # <escape unsafe chars for HTML>
11 # Maybe this could be done more efficiently...
12 package PublicInbox::Linkify;
15 use Digest::SHA qw/sha1_hex/;
18 my $LINK_RE = qr!\b((?:ftp|https?|nntp)://
20 ?[\@\w\+\&\?\.\%\;/#=-]*)!x;
22 sub new { bless {}, shift }
30 # it's fairly common to end URLs in messages with
31 # '.' or ';' to denote the end of a statement.
32 if ($url =~ s/(\.)\z// || $url =~ s/(;)\z//) {
36 # salt this, as this could be exploited to show
37 # links in the HTML which don't show up in the raw mail.
38 my $key = sha1_hex($url . $SALT);
40 # only escape ampersands, others do not match LINK_RE
43 'PI-LINK-'. $key . $end;
51 # Added "PI-LINK-" prefix to avoid false-positives on git commits
52 $s =~ s!\bPI-LINK-([a-f0-9]{40})\b!
54 my $url = $self->{$key};
56 "<a\nhref=\"$url\">$url</a>";
58 # false positive or somebody tried to mess with us