Disable XML entity loader by default in libphutil

Summary:
See <https://www.facebook.com/BugBounty/posts/778897822124446> and <http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution>.

By default, `SimpleXMLElement` will pretty much just run whatever code you want when handed a specially crafted document. We currently load XML only from trusted (S3, EC2, git/svn/hg) or local sources (unit test runners) so there are no concrete vulnerabilities in Phabricator, but this behavior is incredibly dangerous, surprising, and highly undesirable.

Test Plan: There's an example of a document which does bad things on <http://www.php.net/manual/en/function.libxml-disable-entity-loader.php>. I verified that `SimpleXMLElement` reads `/etc/passwd` when handed this document, then applied the fix. It no longer reads arbitrary files off disk.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D8049
Add WARNING and IMPORTANT to remarkup

Summary:
Ref T3116. This is basically the NOTE: rule except we consume WARNING and IMPORTANT.

Also adds (X) syntax for all three of (NOTE), (WARNING), and (IMPORTANT), which behave like the colon versions, just eating the keywords in html rendering.

Test Plan: played with it in phabricator proper; see next diff. also wrote a unit test

Reviewers: epriestley

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Maniphest Tasks: T3116

Differential Revision: https://secure.phabricator.com/D8052
Fixed missing symbols

Summary: Some symbols/files that are not defined have crept into the `__phutil_library_map__.php` file. In this revision, I fix this problem by running `arc liberate`, and also add a unit test to prevent this from occuring in the future (the unit test was taken from Phabricator).

Test Plan: `arc unit`

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8056
Fix infinite loop in PhutilFileTree

Summary: In one of our diff we have files with name '10.8' and '10.80' in the same dir, which caused infinite loop since numerically they are the same hence getNextSibling() call on 10.80 will always gets itself.

Test Plan: Load the diff with fix.

Reviewers: epriestley, lifeihuang, JoelB, cdentel, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8091
Add "%R" to csprintf(), for printing more readable commands

Summary: Ref T4175. The clone commands we print have quoted arguments, but usually don't need them. Add "%R", which is like "%s" but only adds quotes if they're required. This produces slightly more readable commands in the few cases we're generating commands for users to copy/paste.

Test Plan: Added unit tests. Looked up shell metacharacters to double check my definition.

Reviewers: btrahan, chad

Reviewed By: chad

CC: aran

Maniphest Tasks: T4175

Differential Revision: https://secure.phabricator.com/D8099
Implement a basic `phutil_units()` function for writing "30 days in seconds" readably

Summary:
Fixes T4325. We have a fair amount of `(60 * 60 * 24 * 15) // 15 days` stuff in the codebase, and at least one of them was wrong (15 hours, when 15 minutes was probably intended). I was about to write some more, so I wrote this instead.

Make these self-documenting and harder to get wrong.

(This function could be more sophisticated, but I think this is the only real use case we hit.)

Test Plan: Added and ran unit tests.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4325

Differential Revision: https://secure.phabricator.com/D8126
Allow PHPAST to evalStatic() an n_CONCATENATION_LIST of static nodes

Summary: Ref T1139. Allows evaluation of `pht("a"."b")` -> `ab`.

Test Plan: Successfully evaluated concatenation lists in D8138.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T1139

Differential Revision: https://secure.phabricator.com/D8139
Add support in XHPAST for "(new X)->y" syntax (added in 5.4)

Summary: Ref T4334. Allows XHPAST to parse the access-on-instanciation grammar added in 5.4 Refactors some of the other grammar to be closer to Zend's parser. Adds positive and negative tests for allowed syntax.

Test Plan:
`arc unit`
Ran `generate_php_symbols.php` script on files that previously errored out with "unexpected T_OBJECT_OPERATOR", now there are no errors

Reviewers: epriestley, btrahan, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Maniphest Tasks: T4334

Differential Revision: https://secure.phabricator.com/D8150
Encode username and password correctly in PhutilURI

Summary: Fixes T4374. We do not encode passwords in URIs correctly, so passwords with, e.g., the `@` character do not work correctly.

Test Plan: Added unit tests.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4374

Differential Revision: https://secure.phabricator.com/D8144
XHPAST array_function_derefence support

Summary: Ref. T4334.  Makes "isset(foo()[1])" syntax work, which was added in 5.4

Test Plan:
`arc unit`
Added test case for known-good syntax, TDD'd the grammar file until it worked (mostly scraped from Zend)
`generate_php_symbols.php` of WePay's entire codebase with updated XHPAST, no errors at all.

Reviewers: epriestley, btrahan, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8154
Add AWS Region support to PhutilAWSFuture.

Summary:
Almost [[http://docs.aws.amazon.com/general/latest/gr/rande.html|all]] AWS services endpoints follow this structure: `SERVICE_NAME.REGION_ID.amazonaws.com`. This revision adds support for setting a region in `PhutilAWSFuture`.

There are couple of exceptions to above rule - some services do not have region in their endpoint url (DevPay, Route 53, IAM, Import/Export, Security Token Service), some have a single endpoint in one region (OpsWorks, Support), some are //funky// (S3), but they all can be covered by overriding `getHost()` method.

Test Plan: No tests added. I `ack`ed through three repositories (`libphutil`, `arcanist` & `phabricator`) and couldn't find AWS used anywhere.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8311
Add phutil_is_utf8_with_only_bmp_characters()

Summary:
Ref T1191. We currently use `utf8` charsets in MySQL, which silently truncate characters outside of the basic multilingual plane (larger than U+FFFF) like "Musical G-Clef".

Add a method to detect that a string contains characters outside of this range, and thus that inserting it will silently truncate data.

Test Plan: Added and executed unit tests.

Reviewers: btrahan, arice

Reviewed By: arice

CC: chad, arice, aran

Maniphest Tasks: T1191

Differential Revision: https://secure.phabricator.com/D8310
Implement phutil_is_utf8_with_only_bmp_characters() without segfaulting

Summary: See comments. The regexp based implementation segfaults unpreventably on small inputs. Do it nice and slow in PHP instead.

Test Plan: Ran unit tests.

Reviewers: btrahan, arice

Reviewed By: arice

CC: chad, arice, aran

Differential Revision: https://secure.phabricator.com/D8312
Reject nonminmal representations of UTF8 at the beginning of the 3-byte BMP range

Summary: Ref T1191. These byte ranges (\xE0\x80\x80 through \xE0\x9F\xBF) are alternate representations of characters with a different preferred minimal representation. MySQL and mbstring both reject them, and we should too.

Test Plan: Ran unit tests.

Reviewers: btrahan, arice

Reviewed By: arice

CC: chad, arice, aran

Maniphest Tasks: T1191

Differential Revision: https://secure.phabricator.com/D8313
Change "%s" in qsprintf to exclude non-BMP characters

Summary:
Ref T1191. Make `%s` in qsprintf reject non-BMP characters. Introduce `%B` for escaping binary strings.

Basically, this just makes "yes, I want to put binary data in this column" explicit.

Test Plan: See next diff for test coverage in Phabricator.

Reviewers: btrahan, arice

Reviewed By: arice

CC: chad, arice, aran

Maniphest Tasks: T1191

Differential Revision: https://secure.phabricator.com/D8315
Remove "supportsStateParameter()" from generic OAuth2 code

Summary:
Depends on D8318. All providers must support this, or they can't be implemented securely. This is based on a very old reading of the GitHub instructions or something like that which didn't mention "state", but the provider supports it.

This has no impact at runtime because no provider has ever returned `false` from this method, nor would we ever implement a provider that did.

Test Plan: Grepped for callsites.

Reviewers: btrahan, arice

Reviewed By: arice

CC: chad, arice, aran

Differential Revision: https://secure.phabricator.com/D8319
Fix phutil_is_utf8_with_only_bmp_characters() for partial valid characters

Summary:
We don't get partial 2-byte and 3-byte UTF8 characters quite correct, fataling instead of returning `false` because we access past the end of the string.

Instead, bail early if we run off the end of the string without seeing any issues.

Test Plan: Added and executed unit tests.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D8321
Updated `.arcconfig` to match newer style configuration.

Summary: If I'm not mistaken, `project_id` was recently replaced by `project.name` and `conduit_uri` replaced by `phabricator.uri`.

Test Plan: I guess if this differential works, then everything is okay.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8334
Minor linter fixes

Summary:
Fixed various linter issues that were identified with `arc lint --everything`.

- Changed tabs to spaces.
- Removed trailing newlines.
- Added whitespace on either side of binary operator.
- Added newline at EOF.
- Minor spelling fix.
- Removed leading newlines.

Test Plan: N/A

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8335
Made the `AphrontWriteGuardExitEventListener` class final.

Summary: Self explanatory... Otherwise a linter warning is raised.

Test Plan: N/A

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8350