diff options
author | Javier Rojas <jerojasro@devnull.li> | 2012-01-15 19:16:44 -0500 |
---|---|---|
committer | Javier Rojas <jerojasro@devnull.li> | 2012-01-15 19:16:59 -0500 |
commit | 19c126dacb23bcd49fdf610e51c75f55bda23b90 (patch) | |
tree | ed1ad3f7773e721e8544220a199c3c7d249705d2 | |
parent | af8cd9a924e30952250caf44d2f9d8a6b0b315ba (diff) | |
download | ikiwiki-19c126dacb23bcd49fdf610e51c75f55bda23b90.tar ikiwiki-19c126dacb23bcd49fdf610e51c75f55bda23b90.tar.gz |
reply - search attachments
-rw-r--r-- | doc/forum/index_attachments/comment_2._comment | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/doc/forum/index_attachments/comment_2._comment b/doc/forum/index_attachments/comment_2._comment new file mode 100644 index 000000000..a5421bf00 --- /dev/null +++ b/doc/forum/index_attachments/comment_2._comment @@ -0,0 +1,30 @@ +[[!comment format=mdwn + nickname="jerojasro" + subject="RE: comment 1" + date="2012-01-15T23:49:49Z" + content=""" +I've modified the plugin adding the possibility of indexing attachments. Only +PDF attachments for now, but support for other filetypes should be real easy to add. + +The changes to `IkiWiki/Plugin/search.pm` are available at +<http://git.devnull.li/ikiwiki.git>, in the `srchatt` branch. + +I have a small question about filenames and security: I'm using `qx` to execute +the program that extracts the text from the PDF files, but `qx` executes a +whole string, and passes it not to the program I want to run, but to a shell, +so it is possible (I think) to craft a filename that, in a shell, expands to +something nasty. + +How do the Perl/IkiWiki experts suggest to handle these potentially unsafe +filenames? I've thought of the following options: + + * Running the text extractor program using `Proc::Safe`. I could not find a + Debian package for it, and I'd rather avoid adding another dependency to + IkiWiki. + * Running the text extractor program as suggested in the `perlipc` document, + using `fork` + `exec`. + +I haven't done any of those because I'd like to check if there are any helpers +in IkiWiki to do this. Perhaps the `IkiWiki::possibly_foolish_untaint` function +does it? (I didn't really understand what it does...) +"""]] |