Serendipity Forums

Posted: **Mon May 21, 2007 5:54 pm**

Hi,

can some of you tell me how I have to configure my blog so that users can post C++ source code (eg. with geshi)? The posts get truncated after the "<<":

When I try to post a comment in my blog that contains C++ source code like:

Code: Select all

std::ostream operator<<(foo, bar);

the comment looks like this:

Code: Select all

std::ostream operator

that is, everything after the "<<" is missing. Thus, geshi is not working, as the closing [/geshi] is missing.
I tried to HTML encode the "<" with "<", but then I get

Code: Select all

std::ostream operator<<(foo,bar);

that is, the HTML encoding is ignored (or, the ampersands are HTML encoded...)

My event plugin list is:
Markup Geshi, Markup Markdown, Markup Serendipity, Markdown Emoticate, (followed by Browser Compatibility, Spam Protector, Link List, Spartacus, Tagging of Entries, Trackback Control).
All markup plugins are active for comments.

I tried several different orders of the plugins to no avail. I removed the NL2BR
plugin, as it somehow has troubles with the geshi and markdown plugin.

Thank you for your help in advance,

interp.

Posted: **Tue May 22, 2007 2:59 pm**

Hi!

You might want to try to install the plugin "Transforms HTML for comments" which should undo the stripping of "<<" tags.

HTH,
Garvin

Posted: **Tue May 22, 2007 6:52 pm**

Hi garvinhicking,

thank you for your reply.

Yes, the plugin "Transforms HTML for comments" undoes the stripping of "<<" for "regular" text, but then the C++ source code gets messed up inside geshi. If I say (with "Transform HTML for comments" as the first markup module)

Code: Select all

outside geshi: "<<"
[geshi lang=cpp]
std::operator<< foo;
[/geshi]

I get

Code: Select all

outside geshi: "<<"

std::operator<< foo;

Do you know how I can get the "<<" both inside and outside of geshi to work?
I am not sure, if this is an issue with geshi, the "transform html"-module or the handling of comments in serendipity.

Posted: **Wed May 23, 2007 11:33 am**

Hi!

Hnmn, the problem seems to be that geshi translates '<<' to HTML entities, and HTML entities get transformed by the internal s9y routines.

Did you try to put the unstrip entities plugin AFTER the geshi markup plugin?

Maybe you can even trick the system if the plugin can be installed twice, once before and once after the plugin? I'm not really sure, I must admit, since I don't use Geshi and never used the comment form to post code snippets.

One could write his own markup plugin that you can place at the end, which could also unescape any html comments before they get passed on the the internal comment routine. Do you know some basic PHP to copy the the unstrip-plugin and modify it to do that job for you?

Regards,
Garvin

Posted: **Wed May 23, 2007 4:12 pm**

garvinhicking wrote:Did you try to put the unstrip entities plugin AFTER the geshi markup plugin?

Things get really messy if I do this

Code: Select all

std::operator<< foo;
[geshi lang=cpp]
std::operator<< foo;
[/geshi]

gets

Code: Select all

std::operator<< foo; <div class="cpp" style="text-align: left"><br />std::<span style="color: #008f99;">operator</span><< foo;<br /> </div>

garvinhicking wrote:Maybe you can even trick the system if the plugin can be installed twice, once before and once after the plugin? I'm not really sure, I must admit, since I don't use Geshi and never used the comment form to post code snippets.

What do you use to post small code snippets in comments?

garvinhicking wrote:One could write his own markup plugin that you can place at the end, which could also unescape any html comments before they get passed on the the internal comment routine. Do you know some basic PHP to copy the the unstrip-plugin and modify it to do that job for you?

Yes, I can try to do that. Is there an overview or some debugging interface with which I can check what the comments look like when they pass the various plugins until they get comitted (as in the OP, everything after the '<<' did not even get sent to my browser)? I could not find such thing in the technical docs.

As a last note: to me it looks like something with the plugin-chain is wrong, when several plugins and s9y handle html entities...

Thank you for your help, garvinhicking.

interp.

Posted: **Thu May 24, 2007 1:11 pm**

Hi!

What do you use to post small code snippets in comments?

I usually use simple BBCode markup and use \

Code: Select all

 blocks. I personally have never used Geshi.

[quote]Yes, I can try to do that.  Is there an overview or some debugging interface with which I can check what the comments look like when they pass the various plugins until they get comitted (as in the OP, everything after the '<<' did not even get sent to my browser)? I could not find such thing in the technical docs. [/quote]

You could add the debugging into the plugin. Check out the plugin file, like the unstrip-tags one, it has this:

[code]
case 'frontend_display':
                    if (isset($eventData ['comment']) && !empty($eventData['body'])) {
                        $eventData['comment'] = htmlspecialchars($eventData['body']);
                    }

The 'frontend_display' event hook is where all plugins to their magic to any comments. The comment body itself is always inside the $eventData['comment'] variable, which gets altered one after another by the plugins.

As a last step, the serendipity core does an "unstrip_tags(...)" on $eventData['comment'].

The core does this to really ensure that never HTML code is passed on to the blog, as a last-man-standing security guard to prevent XSS attacks.

Best regards,
Garvin

Posted: **Thu May 24, 2007 2:01 pm**

Hi!

garvinhicking wrote:Hi!
I usually use simple BBCode markup and use \

Code: Select all

 blocks. I personally have never used Geshi.
[/quote]
Geshi adds syntax highlighting, which I like. The BBCode markup seems to only work in conjunction with the NL2BR plugin, which in turn does not work with the markdown plugin that I prefer...

[quote]As a last step, the serendipity core does an "unstrip_tags(...)" on $eventData['comment'].

The core does this to really ensure that never HTML code is passed on to the blog, as a last-man-standing security guard to prevent XSS attacks.
[/quote]

Although I like the idea of a "last-man-standing", the concept seems bogus to me: ampersand gets encoded, while '<' gets stripped away, even when there is no closing '>'. I'll think about the problem and come back with a better idea...

Thank you for your help,

interp.

Posted: **Thu May 24, 2007 2:44 pm**

Hi!

Although I like the idea of a "last-man-standing", the concept seems bogus to me: ampersand gets encoded, while '<' gets stripped away, even when there is no closing '>'. I'll think about the problem and come back with a better idea...

But that's the idea of "strip_tags", the PHP function. Everything between < and > gets striped, this ensures that nobody can inject HTML. All other escaping can possible lead to exploitation.

Best regards,
Garvin

Serendipity Forums

C++ source code in comments

C++ source code in comments

Re: C++ source code in comments

Re: C++ source code in comments

Re: C++ source code in comments

Re: C++ source code in comments

Re: C++ source code in comments

Re: C++ source code in comments

Re: C++ source code in comments