According to the important note section of a recent security advisory, GeSHi filter (as well as codefilter) will no longer work, because they intentionally insert invalid UTF-8 characters in the preprocess stage of the filter (eg. xFE and xFF). Drupal 5.6 and Drupal 6 RC2 will cause any text using GeSHi filter to not be displayed.

CommentFileSizeAuthor
#2 geshifilter_xFExFF_208635_2.patch3.13 KBsoxofaan
#1 geshifilter_xFExFF_208635_1.patch2.91 KBsoxofaan

Comments

soxofaan’s picture

soxofaan commented
Version: 6.x-1.x-dev » 5.x-2.x-dev
Status: Active » Needs review
StatusFileSize
new geshifilter_xFExFF_208635_1.patch2.91 KB

I'l start with fixing GeSHi filter 5.x-2.x, because the Drupal 6 version is still under development.

This patch replaces the usage of the "\xFE" and "\xFF" bytes with good old fashioned '[' and ']' characters.

It seems to work in all my tests, but I'd prefer other people try it too before I commit it.

soxofaan’s picture

soxofaan commented
StatusFileSize
new geshifilter_xFExFF_208635_2.patch3.13 KB

New version of patch from #1,
but instead of plain '[' and ']' I added a 'geshifilter' prefix to the mix as sort of namespace thingy to prevent possible collisions with other filters.
For example: in the preparation pass the string "<python>foo</python>" becomes "[geshifilter-python]foo[/geshifilter-python]".

aclight’s picture

aclight commented
Status: Needs review » Needs work

I tried out this patch, but I'm not sure it's working correctly.

The caveat here is that I upgraded my site to 5.6 at the same time I upgraded geshifilter from 2.1 to 2.x-dev, so I'm not sure if the patch is to blame for my problem.

The problem is that if I set the default highlighting mode to plain text, code for all of my languages is processed by geshi (I can tell because the spacing and indenting is correct) but there is no syntax coloring. The raw HTML source of the page has the code surrounded by div's of class geshifilter but that's it.

So, for example, one of my languages is called "igor".

If I have code surrounded by <igor></igor> tags, it is formatted (whitespace) but not colored when the default highlighting mode is plain text, but if I set the default highlighting mode to "Igor" the same code is colored and formatted correctly.

I don't have the time right now to dig into this and see if it's the patch that's causing this or if it's a problem with 2.3 vs 2.1 or if it's a configuration problem on my site.

soxofaan’s picture

soxofaan commented

Some questions about the problem from #3:
Did everything work before the upgrade to Drupal 5.6?
Are there other filters in the used input format? If so, which ones, in which order?
Do other tags work, like [igor]...[/igor], [code type="igor"]...[/code], <code type="igor">...</code>?
Does the problem occur with both patch #1 and patch #2?

thanks for testing

The Fiddler’s picture

The Fiddler commented

Another user affected by the problem:

Using Drupal 5.2-5.5 with Geshi filter 2.1 works.

After updating to Drupal 5.6 all nodes containing code tags stopped displaying content.

I will test the patches shortly and post back. This issue is critical.

soxofaan’s picture

soxofaan commented
Priority: Critical » Normal
Status: Needs work » Active

I decided to commit the patch to 5.x-2.x-dev and CVS HEAD already since it is a critical issue and I received more success reports of the patch than failure reports (it is not clear if the problem in #3 is due to the patch). A similar patch for the related issue with codefilter also got in today.

I'll leave this thread active (instead of fixed) however for further discussion about #3 and #5

aclight’s picture

aclight commented
Status: Active » Fixed

Some questions about the problem from #3:
Did everything work before the upgrade to Drupal 5.6?

While running D5.4 and Geshifilter 2.1, everything worked as expected. I upgraded to D5.6 and geshifilter 2.3 at the same time, so I can't isolate the changed behavior to the drupal core upgrade vs. the geshifilter upgrade.

Are there other filters in the used input format? If so, which ones, in which order?

Filters in this input format are, from lightest to heaviest, URL, HTML, line break, GeSHi.

Do other tags work, like [igor]...[/igor], [code type="igor"]...[/code], ...?

Strangely enough, if I try to change the tag style from the page at admin/settings/filters/1/configure to either [foo] or or [foo] and click the save button, on reload it is still specified as . This is probably a separate problem, but maybe not. Using <code type="igor"> or [code type="igor"] tags results in the text not being processed by geshifilter at all.

Does the problem occur with both patch #1 and patch #2?

I didn't try patch 1.

However, I think the problem I describe might have nothing to do with this patch, because I tried using the 2.3 official release version, but replaced all instances of \xFE with \x01 and \xFF with \x02 and I still get the same problem I'm getting with 2.x-dev with regards to the text being processed by geshi but not highlighted.

So I'll set the status here as fixed, since I think my problem is separate.

I think the problem reported in #5 is just because of the D5.6 upgrade breaking geshi, and is not another instance of the problem I had.

soxofaan’s picture

soxofaan commented

Released GeSHi filter version 5.x-2.4 which includes solution for this issue.

The Fiddler’s picture

The Fiddler commented

Thanks for the quick response, the new version indeed resolves the issue of missing content on Drupal 5.6.

However, it seems there are two issues here: Drupal 5.6 breaking geshifilter (now resolved) and geshifilter 2.4 not highlighting code anymore!

As far as I can see, this is a styling issue: Drupal 5.6/geshifilter 2.4 don't seem to include the needed span elements anymore, while 5.5/2.1 do.

Using geshi 1.0.7.20.

Filters are, from lightest to heaviest, HTML, line break, URL, GeSHi.

Reporting as a different bug.

The Fiddler’s picture

The Fiddler commented

Reported highlighting issue as different bug: http://drupal.org/node/209899

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.