From http://www.jwz.org/xscreensaver/xscreensaver-5.37.tar.gz

[xscreensaver] / driver / xscreensaver-getimage-file

diff --git a/driver/xscreensaver-getimage-file b/driver/xscreensaver-getimage-file
index ee06a79a10407321113f68692351ceb14b499564..f5b7c10748044fae26de2f3e6ecff4ee7fda93d5 100755 (executable)
--- a/driver/xscreensaver-getimage-file
+++ b/driver/xscreensaver-getimage-file
@@ -1,5 +1,5 @@
 #!/usr/bin/perl -w
-# Copyright © 2001-2013 Jamie Zawinski <jwz@jwz.org>.
+# Copyright © 2001-2017 Jamie Zawinski <jwz@jwz.org>.
 #
 # Permission to use, copy, modify, distribute, and sell this software and its
 # documentation for any purpose is hereby granted without fee, provided that
@@ -45,10 +45,6 @@ import Fcntl ':mode' unless defined &S_ISUID;        # but it is here in Perl 5.8
        # but in Perl 5.10, both of these load, and cause errors!
        # So we have to check for S_ISUID instead of S_ISDIR?  WTF?
 
-use bytes;  # Larry can take Unicode and shove it up his ass sideways.
-            # Perl 5.8.0 causes us to start getting incomprehensible
-            # errors about UTF-8 all over the place without this.
-
 use Digest::MD5 qw(md5_base64);
 
 # Some Linux systems don't install LWP by default!
@@ -57,7 +53,7 @@ BEGIN { eval 'use LWP::Simple;' }
 
 
 my $progname = $0; $progname =~ s@.*/@@g;
-my $version = q{ $Revision: 1.37 $ }; $version =~ s/^[^0-9]+([0-9.]+).*$/$1/;
+my ($version) = ('$Revision: 1.43 $' =~ m/\s(\d[.\d]+)\s/s);
 
 my $verbose = 0;
 
@@ -254,7 +250,7 @@ sub read_cache($) {
     $dd = "$ENV{HOME}/.cache/xscreensaver";
     if (! -d $dd) { mkdir ($dd) || error ("mkdir $dd: $!"); }
     $cache_file_name = "$dd/xscreensaver-getimage.cache"
-  } elsif (-d "$ENV{HOME}/tmp") {         # If ~/.tmp/ exists, use it.
+  } elsif (-d "$ENV{HOME}/tmp") {         # If ~/tmp/ exists, use it.
     $cache_file_name = "$ENV{HOME}/tmp/.xscreensaver-getimage.cache";
   } else {
     $cache_file_name = "$ENV{HOME}/.xscreensaver-getimage.cache";
@@ -360,19 +356,28 @@ sub html_unquote($) {
 
 
 
+# Figure out what the proxy server should be, either from environment
+# variables or by parsing the output of the (MacOS) program "scutil",
+# which tells us what the system-wide proxy settings are.
+#
 sub set_proxy($) {
   my ($ua) = @_;
 
-  if (!defined($ENV{http_proxy}) && !defined($ENV{HTTP_PROXY})) {
-    my $proxy_data = `scutil --proxy 2>/dev/null`;
-    my ($server) = ($proxy_data =~ m/\bHTTPProxy\s*:\s*([^\s]+)/s);
-    my ($port)   = ($proxy_data =~ m/\bHTTPPort\s*:\s*([^\s]+)/s);
-    if ($server) {
+  my $proxy_data = `scutil --proxy 2>/dev/null`;
+  foreach my $proto ('http', 'https') {
+    my ($server) = ($proxy_data =~ m/\b${proto}Proxy\s*:\s*([^\s]+)/si);
+    my ($port)   = ($proxy_data =~ m/\b${proto}Port\s*:\s*([^\s]+)/si);
+    my ($enable) = ($proxy_data =~ m/\b${proto}Enable\s*:\s*([^\s]+)/si);
+
+    if ($server && $enable) {
       # Note: this ignores the "ExceptionsList".
-      $ENV{http_proxy} = "http://" . $server . ($port ? ":$port" : "") . "/";
-      print STDERR "$progname: MacOS proxy: $ENV{http_proxy}\n"
-        if ($verbose > 2)
-      }
+      my $proto2 = 'http';
+      $ENV{"${proto}_proxy"} = ("${proto2}://" . $server .
+                                ($port ? ":$port" : "") . "/");
+      print STDERR "$progname: MacOS $proto proxy: " .
+                   $ENV{"${proto}_proxy"} . "\n"
+        if ($verbose > 2);
+    }
   }
 
   $ua->env_proxy();
@@ -382,7 +387,7 @@ sub set_proxy($) {
 sub init_lwp() {
   if (! defined ($LWP::Simple::ua)) {
     error ("\n\n\tPerl is broken. Do this to repair it:\n" .
-           "\n\tsudo cpan LWP::Simple\n");
+           "\n\tsudo cpan LWP::Simple LWP::Protocol::https Mozilla::CA\n");
   }
   set_proxy ($LWP::Simple::ua);
 }
@@ -399,15 +404,28 @@ sub parse_feed($) {
   $LWP::Simple::ua->agent ("$progname/$version");
   $LWP::Simple::ua->timeout (10);  # bail sooner than the default of 3 minutes
 
+
+  # Half the time, random Linux systems don't have Mozilla::CA installed,
+  # which results in "Can't verify SSL peers without knowning which
+  # Certificate Authorities to trust".
+  #
+  # In xscreensaver-text we just disabled certificate checks. However,
+  # malicious images really do exist, so for xscreensaver-getimage-file,
+  # let's actually require that SSL be installed properly.
+
+
   my $body = (LWP::Simple::get($url) || '');
 
-  if ($body !~ m@^<\?xml\s@si) {
+  if ($body !~ m@^\s*<(\?xml|rss)\b@si) {
     # Not an RSS/Atom feed.  Try RSS autodiscovery.
 
     # (Great news, everybody: Flickr no longer provides RSS for "Sets",
     # only for "Photostreams", and only the first 20 images of those.
     # Thanks, assholes.)
 
+    error ("null response: $url")
+      if ($body =~ m/^\s*$/s);
+
     error ("not an RSS or Atom feed, or HTML: $url")
       unless ($body =~ m@<(HEAD|BODY|A|IMG)\b@si);
 
@@ -612,6 +630,10 @@ sub download_image($$$) {
   #     _q  square, 150x150
   #     _s  square,  75x75
   #
+  # Note: if we wanted to get the _k or _o version instead of the _b or _h
+  # version, we'd need to crack the DRM -- which is easy: see crack_secret
+  # in "https://www.jwz.org/hacks/galdown".
+  #
   $url =~ s@_[sqtmnzc](\.[a-z]+)$@_b$1@si
     if ($url =~ m@^https?://[^/?#&]*?flickr\.com/@si);
 
@@ -643,7 +665,7 @@ sub mirror_feed($) {
     if (! -d $dir) { mkdir ($dir) || error ("mkdir $dir: $!"); }
     $dir .= "/feeds";
     if (! -d $dir) { mkdir ($dir) || error ("mkdir $dir: $!"); }
-  } elsif (-d "$ENV{HOME}/tmp") {         # If ~/.tmp/ exists, use it.
+  } elsif (-d "$ENV{HOME}/tmp") {         # If ~/tmp/ exists, use it.
     $dir = "$ENV{HOME}/tmp/.xscreensaver-feeds";
   } else {
     $dir = "$ENV{HOME}/.xscreensaver-feeds";