Merge branch '4.4.8-releng' into 4.4-trunk

Author: sunnavy

etc/RT_Config.pm.in

@@ -2633,6 +2633,26 @@ higher numbers denoting greater effort.
 
 Set($BcryptCost, 12);
 
+=item C<@RestrictLinkDomains>
+
+This sets a list of external domains that RT is allowed to link to. If this
+setting is empty, no external domains are allowed.
+
+Currently, this restriction only applies to links in Format parameter for
+search results. All external links whose domains are not in the list will
+be removed.
+
+E.g.
+
+    Set(@RestrictLinkDomains, ("example.com", "*.trusted.com"));
+
+    example.com    # Allow links to "example.com"
+    *.trusted.com  # Allow links to any one-level subdomain of "trusted.com"
+
+=cut
+
+Set(@RestrictLinkDomains, ());
+
 =back
 
 
@@ -3150,6 +3170,9 @@ Set C<CheckRevocationDownloadTimeout> to the timeout in seconds for
 downloading a CRL or an issuer certificate (the latter is used when
 checking against OCSP).  The default timeout is 30 seconds.
 
+Set C<Cipher> to the encryption algorithm to use. By default, it's
+C<aes-128-cbc>.
+
 See L<RT::Crypt::SMIME> for details.
 
 =back
@@ -3168,6 +3191,7 @@ Set( %SMIME,
     CheckCRL => 0,
     CheckOCSP => 0,
     CheckRevocationDownloadTimeout => 30,
+    Cipher => 'aes-128-cbc',
 );
 
 =head2 GnuPG configuration

lib/RT/Crypt/SMIME.pm

@@ -430,7 +430,7 @@ sub _SignEncrypt {
             $key = $key_file;
         }
         push @commands, [
-            $self->OpenSSLPath, qw(smime -encrypt -des3),
+            $self->OpenSSLPath, qw(smime -encrypt), '-' . ( $opts->{Cipher} || 'aes-128-cbc' ),
             map { $_->filename } @keys
         ];
     }

lib/RT/Interface/Web.pm

@@ -4611,12 +4611,20 @@ Removes unsafe and undesired HTML from the passed content
 =cut
 
 my $SCRUBBER;
+my $RESTRICTIVE_SCRUBBER;
 sub ScrubHTML {
     my $Content = shift;
-    $SCRUBBER = _NewScrubber() unless $SCRUBBER;
+    my %args = @_;
 
     $Content = '' if !defined($Content);
-    return $SCRUBBER->scrub($Content);
+    if ( $args{Restrictive} ) {
+        $RESTRICTIVE_SCRUBBER = _NewScrubber(Restrictive => 1) unless $RESTRICTIVE_SCRUBBER;
+        return $RESTRICTIVE_SCRUBBER->scrub($Content);
+    }
+    else {
+        $SCRUBBER = _NewScrubber() unless $SCRUBBER;
+        return $SCRUBBER->scrub($Content);
+    }
 }
 
 =head2 _NewScrubber
@@ -4698,7 +4706,45 @@ if (RT->Config->Get('ShowTransactionImages') or RT->Config->Get('ShowRemoteImage
     $SCRUBBER_RULES{'img'}->{'src'} = join "|", @src;
 }
 
+our %RESTRICTIVE_SCRUBBER_RULES = (
+    a => {
+        %SCRUBBER_ALLOWED_ATTRIBUTES,
+        href => sub {
+            my ( $self, $tag, $attr, $href ) = @_;
+            return $href unless $href;
+
+            # Allow internal RT macros like __WebPath__, etc.
+            return $href if $href !~ /^\w+:/ && $href =~ $SCRUBBER_ALLOWED_ATTRIBUTES{'href'};
+
+            my $uri = URI->new($href);
+            unless ( $uri->can("host") && $uri->host ) {
+                RT->Logger->warn("Unknown link: $href");
+                return '';
+            }
+
+            my $rt_host = RT::Interface::Web::_NormalizeHost( RT->Config->Get('WebBaseURL') )->host;
+            my $host    = lc $uri->host;
+            for my $allowed_domain ( $rt_host, @{ RT->Config->Get('RestrictLinkDomains') || [] } ) {
+                if ( $allowed_domain =~ /\*/ ) {
+
+                    # Turn a literal * into a domain component or partial component match.
+                    my $regex = join "[a-zA-Z0-9\-]*", map { quotemeta($_) }
+                        split /\*/, $allowed_domain;
+                    return $href if $host =~ /^$regex$/i;
+                }
+                else {
+                    return $href if $host eq lc($allowed_domain);
+                }
+            }
+
+            RT->Logger->warning("Blocked link: $href");
+            return '';
+        },
+    },
+);
+
 sub _NewScrubber {
+    my %args = @_;
     require HTML::Scrubber;
     my $scrubber = HTML::Scrubber->new();
 
@@ -4726,7 +4772,7 @@ sub _NewScrubber {
     );
     $scrubber->deny(qw[*]);
     $scrubber->allow(@SCRUBBER_ALLOWED_TAGS);
-    $scrubber->rules(%SCRUBBER_RULES);
+    $scrubber->rules( %SCRUBBER_RULES, $args{Restrictive} ? %RESTRICTIVE_SCRUBBER_RULES : () );
 
     # Scrubbing comments is vital since IE conditional comments can contain
     # arbitrary HTML and we'd pass it right on through.

share/html/Asset/Elements/TSVExport

@@ -58,7 +58,7 @@ require HTML::Entities;
 
 $r->content_type('application/vnd.ms-excel');
 
-my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format);
+my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
 
 my @Format = $m->comp('/Elements/CollectionAsTable/ParseFormat', Format => $DisplayFormat);
 

share/html/Elements/CollectionList

@@ -93,8 +93,8 @@ $Collection->GotoPage( $Page - 1 ); # SB uses page 0 as the first page
 $DisplayFormat ||= $Format;
 
 # Scrub the html of the format string to remove any potential nasties.
-$Format = $m->comp('/Elements/ScrubHTML', Content => $Format);
-$DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $DisplayFormat);
+$Format = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
+$DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $DisplayFormat, Restrictive => 1);
 
 my @Format = $m->comp('/Elements/CollectionAsTable/ParseFormat', Format => $DisplayFormat);
 

share/html/Elements/ScrubHTML

@@ -46,7 +46,7 @@
 %#
 %# END BPS TAGGED BLOCK }}}
 <%init>
-return ScrubHTML($Content);
+return ScrubHTML($Content, %ARGS);
 </%init>
 <%args>
 $Content => undef

share/html/Elements/TSVExport

@@ -62,7 +62,7 @@ $Class ||= $Collection->ColumnMapClassName;
 $r->content_type('application/vnd.ms-excel');
 $r->header_out( 'Content-disposition' => "attachment; filename=$Filename" ) if $Filename;
 
-my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format);
+my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
 
 my @Format = $m->comp('/Elements/CollectionAsTable/ParseFormat', Format => $DisplayFormat);
 

share/html/Search/Build.html

@@ -159,7 +159,7 @@
     }
     if ( $query{'Format'} ) {
         # Clean unwanted junk from the format
-        $query{'Format'} = $m->comp( '/Elements/ScrubHTML', Content => $query{'Format'} );
+        $query{'Format'} = $m->comp( '/Elements/ScrubHTML', Content => $query{'Format'}, Restrictive => 1 );
     }
 }
 

share/html/Search/Edit.html

@@ -64,7 +64,7 @@
 
 <%INIT>
 my $title = loc("Edit Query");
-$Format = $m->comp('/Elements/ScrubHTML', Content => $Format);
+$Format = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
 my $QueryString = $m->comp('/Elements/QueryString',
                            Query   => $Query,
                            Format  => $Format,