@@ -110,8 +110,9 @@ import Data.Char ( toLower, isLower, isUpper, isAlpha,
110import Data.List ( find, stripPrefix, intercalate )
110import Data.List ( find, stripPrefix, intercalate )
111import Data.Version ( showVersion )
111import Data.Version ( showVersion )
112import qualified Data.Map as M
112import qualified Data.Map as M
113−import Network.URI ( escapeURIString, isURI, nonStrictRelativeTo,
113+import Network.URI ( escapeURIString, nonStrictRelativeTo,
114− unEscapeString, parseURIReference, isAllowedInURI )
114+ unEscapeString, parseURIReference, isAllowedInURI,
115import qualified Data.Set as Set
116import qualified Data.Set as Set
116import System.Directory
117import System.Directory
117import System.FilePath (splitDirectories, isPathSeparator)
118import System.FilePath (splitDirectories, isPathSeparator)
@@ -879,18 +880,30 @@ readDataFileUTF8 :: Maybe FilePath -> FilePath -> IO String
879readDataFileUTF8 userDir fname =
880readDataFileUTF8 userDir fname =
880 UTF8.toString `fmap` readDataFile userDir fname
881 UTF8.toString `fmap` readDataFile userDir fname
883+-- | Specialized version of parseURIReference that disallows
884+-- single-letter schemes. Reason: these are usually windows absolute
886+parseURIReference' :: String -> Maybe URI
887+parseURIReference' s =
888+ case parseURIReference s of
889+ Just u | length (uriScheme u) > 2 -> Just u
882-- | Fetch an image or other item from the local filesystem or the net.
892-- | Fetch an image or other item from the local filesystem or the net.
883-- Returns raw content and maybe mime type.
893-- Returns raw content and maybe mime type.
884fetchItem :: Maybe String -> String
894fetchItem :: Maybe String -> String
885 -> IO (Either E.SomeException (BS.ByteString, Maybe MimeType))
895 -> IO (Either E.SomeException (BS.ByteString, Maybe MimeType))
886fetchItem sourceURL s =
896fetchItem sourceURL s =
887− case (sourceURL >>= parseURIReference . ensureEscaped, ensureEscaped s) of
897+ case (sourceURL >>= parseURIReference' . ensureEscaped, ensureEscaped s) of
888− (_, s') | isURI s' -> openURL s'
889 (Just u, s') -> -- try fetching from relative path at source
898 (Just u, s') -> -- try fetching from relative path at source
890− case parseURIReference s' of
899+ case parseURIReference' s' of
891 Just u' -> openURL $ show $ u' `nonStrictRelativeTo` u
900 Just u' -> openURL $ show $ u' `nonStrictRelativeTo` u
892 Nothing -> openURL s' -- will throw error
901 Nothing -> openURL s' -- will throw error
903+ case parseURI s' of -- requires absolute URI
904+ -- We don't want to treat C:/ as a scheme:
905+ Just u' | length (uriScheme u') > 2 -> openURL (show u')
893− (Nothing, _) -> E.try readLocalFile -- get from local file system
906+ _ -> E.try readLocalFile -- get from local file system
894 where readLocalFile = do
907 where readLocalFile = do
895 cont <- BS.readFile fp
908 cont <- BS.readFile fp
896 return (cont, mime)
909 return (cont, mime)