Issue 520 - Generate PAD files for download portals when updating download links

sitescripts/extensions/pad/validation.py

+# This file is part of the Adblock Plus web scripts,
+# Copyright (C) 2006-2014 Eyeo GmbH
+#
+# Adblock Plus is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3 as
+# published by the Free Software Foundation.
+#
+# Adblock Plus is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
+
+import re, warnings
+
+try:
+  import libxml2
+except ImportError:
+  libxml2 = None
+  warnings.warn('libxml2 is not installed, can not validate PAD files')
+
+FIELDS = [
+  ('/XML_DIZ_INFO/MASTER_PAD_VERSION_INFO/MASTER_PAD_VERSION', r'^4\.0\Z'),
+  ('/XML_DIZ_INFO/MASTER_PAD_VERSION_INFO/MASTER_PAD_EDITOR', r'^[^<\x09]{0,100}\Z'),
+  ('/XML_DIZ_INFO/MASTER_PAD_VERSION_INFO/MASTER_PAD_INFO', r'^[^<\x09]{0,1000}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Company_Name', r'^[^<\x09]{2,40}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Address_1', r'^[a-zA-Z0-9\xbc-\xff .\-,#\/\x27]{0,40}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Address_2', r'^[a-zA-Z\xbc-\xff0-9 .\-,#\/\x27]{0,40}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/City_Town', r'^[a-zA-Z\xbc-\xff0-9 .\-,#\/\x27]{2,40}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/State_Province', r'^[a-zA-Z\xbc-\xff0-9 .\-,\/]{0,30}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Zip_Postal_Code', r'^[^<\x09]{0,20}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Country', r'^[a-z A-Z\xbc-\xff\x27-]{2,40}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Company_WebSite_URL', r'^http:\/\/.{2,120}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Contact_Info/Author_First_Name', r'^[^<\x09]{2,30}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Contact_Info/Author_Last_Name', r'^[^<\x09]{2,30}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Contact_Info/Author_Email', r'^.{2,30}\@.{2,63}\..{2,20}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Contact_Info/Contact_First_Name', r'^[^<\x09]{2,30}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Contact_Info/Contact_Last_Name', r'^[^<\x09]{2,30}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Contact_Info/Contact_Email', r'^.{2,30}\@.{2,63}\..{2,20}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/Sales_Email', r'^.{2,30}\@.{2,63}\..{2,20}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/Support_Email', r'^.{2,30}\@.{2,63}\..{2,20}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/General_Email', r'^.{2,30}\@.{2,63}\..{2,20}\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/Sales_Phone', r'^\+{0,2}(([0-9#*()-\/_] *){7,40})?\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/Support_Phone', r'^\+{0,2}(([0-9#*()-\/_] *){7,40})?\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/General_Phone', r'^\+{0,2}(([0-9#*()-\/_] *){7,40})?\Z'),
+  ('/XML_DIZ_INFO/Company_Info/Support_Info/Fax_Phone', r'^\+{0,2}(([0-9#*()-\/_] *){7,40})?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Name', r'^[^<\x09]{1,40}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Version', r'^[a-zA-Z0-9_.\-]{1,15}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Release_Month', r'^(0[1-9]|1[0-2])\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Release_Day', r'^(0[1-9]|[12][0-9]|3[01])\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Release_Year', r'^(19|20|21)[0-9]{2}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Cost_Dollars', r'^([0-9]+(\.[0-9]{2})?)?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Cost_Other_Code', r'^(AED|AFN|ALL|AMD|ANG|AOA|ARS|AUD|AWG|AZM|BAM|BBD|BDT|BGN|BHD|BIF|BMD|BND|BOB|BRL|BSD|BTN|BWP|BYR|BZD|CAD|CDF|CHF|CLP|CNY|COP|COU|CRC|CSD|CZK|CUP|CVE|CYP|DJF|DKK|DOP|DZD|EEK|EGP|ERN|ETB|EUR|FJD|FKP|GBP|GEL|GHC|GIP|GMD|GNF|GTQ|GYD|HKD|HNL|HRK|HTG|HUF|IDR|ILS|INR|IQD|IRR|ISK|JMD|JOD|JPY|KES|KGS|KHR|KMF|KPW|KRW|KWD|KYD|KZT|LAK|LBP|LKR|LRD|LSL|LTL|LVL|LYD|MAD|MDL|MGA|MKD|MMK|MNT|MOP|MRO|MTL|MUR|MVR|MWK|MXN|MYR|MZN|NAD|NGN|NIO|NOK|NPR|NZD|OMR|PAB|PEN|PGK|PHP|PKR|PLN|PYG|QAR|RON|RUB|RWF|SAR|SBD|SCR|SDD|SEK|SGD|SHP|SIT|SKK|SLL|SOS|SRD|STD|SYP|SZL|THB|TJS|TMM|TND|TOP|TRY|TTD|TWD|TZS|UAH|UGX|USD|UYU|UZS|VEB|VND|VUV|WST|XAF|XCD|XOF|XPF|YER|ZAR|ZMK|ZWD)?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Cost_Other', r'^([0-9]+(\.[0-9]{2})?)?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Type', r'^(Shareware|Freeware|Adware|Demo|Commercial|Data Only)\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Release_Status', r'^(Major Update|Minor Update|New Release|Beta|Alpha|Media Only)\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Install_Support', r'^(Install and Uninstall|Install Only|No InstallSupport|Uninstall Only)\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_OS_Support', r'^((Android|BlackBerry|Handheld\/Mobile Other|iPhone|iPod|iTouch|Java|Linux|Linux Console|Linux Gnome|Linux GPL|Linux Open Source|Mac OS X|Mac Other|MS-DOS|Netware|OpenVMS|Palm|Pocket PC|Symbian|Unix|Win2000|Win7 x32|Win7 x64|Win98|WinMobile|WinOther|WinServer|WinVista|WinVista x64|WinXP|Other|Not Applicable)[, ]*)+\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Language', r'^(Abkhazian|Afar|Afrikaans|Albanian|Amharic|Arabic|Armenian|Assamese|Aymara|Azerbaijani|Bashkir|Basque|Bengali|Bhutani|Bihari|Bislama|Breton|Bulgarian|Burmese|Byelorussian|Cambodian|Catalan|Chinese|ChineseSimplified|ChineseTraditional|Corsican|Croatian|Czech|Danish|Dutch|English|Esperanto|Estonian|Faeroese|Fiji|Finnish|French|Frisian|Gaelic|Galician|Georgian|German|Greek|Greenlandic|Guarani|Gujarati|Hausa|Hebrew|Hindi|Hungarian|Icelandic|Indonesian|Interlingua|Interlingue|Inupiak|Irish|Italian|Japanese|Javanese|Kannada|Kashmiri|Kazakh|Kinyarwanda|Kirghiz|Kirundi|Korean|Kurdish|Laothian|Latin|Latvian|Lingala|Lithuanian|Macedonian|Malagasy|Malay|Malayalam|Maltese|Maori|Marathi|Moldavian|Mongolian|Nauru|Nepali|Norwegian|Occitan|Oriya|Oromo|Other|Pashto|Persian|Polish|Portuguese|Punjabi|Quechua|Rhaeto-Romance|Romanian|Russian|Samoan|Sangro|Sanskrit|Serbian|Serbo-Croatian|Sesotho|Setswana|Shona|Sindhi|Singhalese|Siswati|Slovak|Slovenian|Somali|Spanish|Sudanese|Swahili|Swedish|Tagalog|Tajik|Tamil|Tatar|Telugu|Thai|Tibetan|Tigrinya|Tonga|Tsonga|Turkish|Turkmen|Twi|Ukrainian|Urdu|Uzbek|Vietnamese|Volapuk|Welsh|Wolof|Xhosa|Yiddish|Yoruba|Zulu|,)+\Z'),
+  ('/XML_DIZ_INFO/Program_Info/File_Info/File_Size_Bytes', r'^[0-9]{3,16}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/File_Info/File_Size_K', r'^[0-9.]{1,12}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/File_Info/File_Size_MB', r'^[0-9.]{1,8}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Has_Expire_Info', r'^[YyNn]\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Expire_Count', r'^[0-9]{0,15}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Expire_Based_On', r'^(Days|Uses|Either\/Or)?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Expire_Other_Info', r'^[^<\x09]{0,100}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Expire_Month', r'^(0[1-9]|1[0-2])?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Expire_Day', r'^(0[1-9]|[12][0-9]|3[01])?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Expire_Info/Expire_Year', r'^((19|20|21)[0-9]{2})?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Change_Info', r'^[^<\x09]{0,300}\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Category_Class', r'^(Audio & Multimedia::Audio Encoders\/Decoders|Audio & Multimedia::Audio File Players|Audio & Multimedia::Audio File Recorders|Audio & Multimedia::CD Burners|Audio & Multimedia::CD Players|Audio & Multimedia::Multimedia Creation Tools|Audio & Multimedia::Music Composers|Audio & Multimedia::Other|Audio & Multimedia::Presentation Tools|Audio & Multimedia::Rippers & Converters|Audio & Multimedia::Speech|Audio & Multimedia::Video Tools|Business::Accounting & Finance|Business::Calculators & Converters|Business::Databases & Tools|Business::Helpdesk & Remote PC|Business::Inventory & Barcoding|Business::Investment Tools|Business::Math & Scientific Tools|Business::Office Suites & Tools|Business::Other|Business::PIMS & Calendars|Business::Project Management|Business::Vertical Market Apps|Communications::Chat & Instant Messaging|Communications::Dial Up & Connection Tools|Communications::E-Mail Clients|Communications::E-Mail List Management|Communications::Fax Tools|Communications::Newsgroup Clients|Communications::Other Comms Tools|Communications::Other E-Mail Tools|Communications::Pager Tools|Communications::Telephony|Communications::Web\/Video Cams|Desktop::Clocks & Alarms|Desktop::Cursors & Fonts|Desktop::Icons|Desktop::Other|Desktop::Screen Savers: Art|Desktop::Screen Savers: Cartoons|Desktop::Screen Savers: Nature|Desktop::Screen Savers: Other|Desktop::Screen Savers: People|Desktop::Screen Savers: Science|Desktop::Screen Savers: Seasonal|Desktop::Screen Savers: Vehicles|Desktop::Themes & Wallpaper|Development::Active X|Development::Basic, VB, VB DotNet|Development::C \/ C\+\+ \/ C\#|Development::Compilers & Interpreters|Development::Components & Libraries|Development::Debugging|Development::Delphi|Development ::Help Tools|Development::Install & Setup|Development::Management & Distribution|Development::Other|Development::Source Editors|Education::Computer|Education::Dictionaries|Education::G eography|Education::Kids|Education::Languages|Education::Mathema tics|Education::Other|Education::Reference Tools|Education::Science|Education::Teaching & Training Tools|Games & Entertainment::Action|Games & Entertainment::Adventure & Roleplay|Games & Entertainment::Arcade|Games & Entertainment::Board|Games & Entertainment::Card|Games & Entertainment::Casino & Gambling|Games & Entertainment::Kids|Games & Entertainment::Online Gaming|Games & Entertainment::Other|Games & Entertainment::Puzzle & Word Games|Games & Entertainment::Simulation|Games & Entertainment::Sports|Games & Entertainment::Strategy & War Games|Games & Entertainment::Tools & Editors|Graphic Apps::Animation Tools|Graphic Apps::CAD|Graphic Apps::Converters & Optimizers|Graphic Apps::Editors|Graphic Apps::Font Tools|Graphic Apps::Gallery & Cataloging Tools|Graphic Apps::Icon Tools|Graphic Apps::Other|Graphic Apps::Screen Capture|Graphic Apps::Viewers|Home & Hobby::Astrology\/Biorhythms\/Mystic|Home & Hobby::Astronomy|Home & Hobby::Cataloging|Home & Hobby::Food & Drink|Home & Hobby::Genealogy|Home & Hobby::Health & Nutrition|Home & Hobby::Other|Home & Hobby::Personal Finance|Home & Hobby::Personal Interest|Home & Hobby::Recreation|Home & Hobby::Religion|Network & Internet::Ad Blockers|Network & Internet::Browser Tools|Network & Internet::Browsers|Network & Internet::Download Managers|Network & Internet::File Sharing\/Peer to Peer|Network & Internet::FTP Clients|Network & Internet::Network Monitoring|Network & Internet::Other|Network & Internet::Remote Computing|Network & Internet::Search\/Lookup Tools|Network & Internet::Terminal & Telnet Clients|Network & Internet::Timers & Time Synch|Network & Internet::Trace & Ping Tools|Security & Privacy::Access Control|Security & Privacy::Anti-Spam & Anti-Spy Tools|Security & Privacy::Anti-Virus Tools|Security & Privacy::Covert Surveillance|Security & Privacy::Encryption Tools|Security & Privacy::Other|Security & Privacy::Password Managers|Servers::Firewall & Proxy Servers|Servers::FTP Servers|Servers::Mail Servers|Servers::News Servers|Servers::Other Server Applications|Servers::Telnet Servers|Servers::Web Servers|System Utilities::Automation Tools|System Utilities::Backup & Restore|System Utilities::Benchmarking|System Utilities::Clipboard Tools|System Utilities::File & Disk Management|System Utilities::File Compression|System Utilities::Launchers & Task Managers|System Utilities::Other|System Utilities::Printer|System Utilities::Registry Tools|System Utilities::Shell Tools|System Utilities::System Maintenance|System Utilities::Text\/Document Editors|Web Development::ASP & PHP|Web Development::E-Commerce|Web Development::Flash Tools|Web Development::HTML Tools|Web Development::Java & JavaScript|Web Development::Log Analysers|Web Development::Other|Web Development::Site Administration|Web Development::Wizards & Components|Web Development::XML\/CSS Tools)\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_Specific_Category', r'^(Audio|Business|DevelopmentTools|Education|Games|Graphics|Home\/Hobby|Internet|Miscellaneous|Screen Savers|Utilities)?\Z'),
+  ('/XML_DIZ_INFO/Program_Info/Program_System_Requirements', r'^[^<\x09]{0,100}\Z'),
+  ('/XML_DIZ_INFO/Program_Descriptions/English/Keywords', r'^[^<\x09]{0,250}\Z'),
+  ('/XML_DIZ_INFO/Program_Descriptions/English/Char_Desc_45', r'^[^<\x09\x0a\x0d]{0,45}\Z'),
+  ('/XML_DIZ_INFO/Program_Descriptions/English/Char_Desc_80', r'^[^<\x09\x0a\x0d]{0,80}\Z'),
+  ('/XML_DIZ_INFO/Program_Descriptions/English/Char_Desc_250', r'^[^<\x09\x0a\x0d]{0,250}\Z'),
+  ('/XML_DIZ_INFO/Program_Descriptions/English/Char_Desc_450', r'^[^<\x09\x0a\x0d]{0,450}\Z'),
+  ('/XML_DIZ_INFO/Program_Descriptions/English/Char_Desc_2000', r'^[^<]{0,2000}\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Application_URLs/Application_Info_URL', r'^http:\/\/.{2,120}\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Application_URLs/Application_Order_URL', r'^((http|https):\/\/.{2,120})?\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Application_URLs/Application_Screenshot_URL', r'^http:\/\/.{2,120}\.(gif|jpg|png)\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Application_URLs/Application_Icon_URL', r'^http:\/\/.{2,120}\.(gif|jpg|png)\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Application_URLs/Application_XML_File_URL', r'^http:\/\/.{2,120}\.(xml|cgi|php|asp)\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Download_URLs/Primary_Download_URL', r'^(http|ftp):\/\/.{2,120}\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Download_URLs/Secondary_Download_URL', r'^((http|ftp):\/\/.{2,120})?\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Download_URLs/Additional_Download_URL_1', r'^((http|ftp):\/\/.{2,120})?\Z'),
+  ('/XML_DIZ_INFO/Web_Info/Download_URLs/Additional_Download_URL_2', r'^((http|ftp):\/\/.{2,120})?\Z'),
+  ('/XML_DIZ_INFO/Permissions/Distribution_Permissions', r'^[^<]{0,2000}\Z'),
+  ('/XML_DIZ_INFO/Permissions/EULA', r'^[^<]{0,20000}\Z'),
+]
+
+def validate_pad(pad, filename):
+  if not libxml2:
+    return

[Wladimir Palant, 2014/05/26 10:54:57]

I assume that libxml2 is being used due to its XPath support. Why not use
xml.etree package that is installed by default?

[Sebastian Noack, 2014/05/26 12:04:53]

I just gave etree a try. However their xpath implementation is very limited,
most notable it doesn't support lookups relative to the document root (/).

Also the documentation states that the xml.* modules have known security
vulnerabilities:
https://docs.python.org/2/library/xml.html#xml-vulnerabilities

[Wladimir Palant, 2014/05/26 13:26:53]

Why does it have to? Relative lookups should do just fine if you look up
relative to the document root.
Yes, they have a warning about that at the top. But we are talking about the
data we generated ourselves, it isn't supposed to be malicious.

[Sebastian Noack, 2014/05/27 12:01:23]

I am using mindom (without xpath) now. Also I'm validating against a more recent
version of PAD, that allows HTTPS URLs and Windows 8.

+
+  doc = libxml2.parseDoc(pad)
+  xpctx = doc.xpathNewContext()
+
+  for xpath, regex in FIELDS:
+    nodes = xpctx.xpathEval(xpath)
+
+    if not nodes:
+      warnings.warn('invalid PAD file (missing node)\n'
+                    'filename: %s\n'
+                    'XPath:    %s' % (filename, xpath))
+    else:
+      value = nodes[0].getContent()
+
+      if not re.match(regex, value):
+        warnings.warn('invalid PAD file (invalid value)\n'
+                      'filename: %s\n'
+                      'XPath:    %s\n'
+                      'value:    %s\n'
+                      'regex:    %s' % (filename, xpath, value, regex))