Filter "javascript:" URIs more aggressively

Summary: Some browsers interpret `javascript\n:` as a Javascript URI. Be significantly more aggressive in normalizing URIs when looking for `javascript:` hrefs.

Test Plan: Added and executed unit tests.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8548
Allow multiple LDAP search filters, and complex search queries

Summary: Ref T3208. I'm going to make some people try this before it gets anywhere near landing.

Test Plan: oh man LDAP

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley, frgtn, aran

Maniphest Tasks: T3208

Differential Revision: https://secure.phabricator.com/D8159
Pass an integer to stream_select() for correctness

Summary: Ref T4627. Passing `$timeout_sec` is slightly more correct here, although there is no change to program behavior.

Test Plan:
Used this script to verify that passing `0` and `0.999321` (for example) have the same effect to `stream_select()`:

  <?php

  $spec = array(
    0 => array('pipe', 'r'),
    1 => array('pipe', 'w'),
    2 => array('pipe', 'w'),
  );

  $pipes = array();
  $proc = proc_open('sleep 30', $spec, $pipes);
  list($stdin, $stdout, $stderr) = $pipes;

  $read = array($stdout, $stderr);
  $write = array();
  $except = array();

  $select_start = microtime(true);
  stream_select($read, $write, $except, 0.999321, 80000);
  $select_end = microtime(true);

  printf(
    "select() took %d us to return.\n",
    ($select_end - $select_start) * 1000000);

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4627

Differential Revision: https://secure.phabricator.com/D8567
Put a <span> around "NOTE:" in Remarkup

Summary: I suspect these will look better if we bold/grey the "NOTE:" part.

Test Plan: Ran unit tests. Will try styling next.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8596
Add array method dereference support to xhpast.

Summary: Adds support for array method dereferencing, e.g. `$foo->bar()[0]`. Bumps XHPAST version. Ref T4334.

Test Plan: Wrote two failing unit tests for language parsing abilities using the specific errors mentioned in T4334. Hacked away at the parser importing bits from Zend's zend_language_parser.y until they passed.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Maniphest Tasks: T4334

Differential Revision: https://secure.phabricator.com/D8611
Use new Google+ API for Google auth instead of "userinfo"

Summary:
Google is moving away from the APIs we're using, as described in this timetable:

  https://developers.google.com/+/api/auth-migration#timetable

Although the timetable says the API is good until Sept 1, 2014, we're seeing the API fail on `secure.phabricator.com` and have received user reports of failures as well.

I can't figure out any configuration changes that users can make to keep the current APIs working, so just upgrade to the new ones.

Test Plan: Registered and logged in with Google.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: charles, epriestley

Differential Revision: https://secure.phabricator.com/D8612
Improve instructions for Google auth mess

Summary:
See T4676 for context. @csilvers suggested that these changes would have been helpful in resolving this issue.

If we get like one more report I'll probably try to back this out and phase it in more gradually instead, although we're going to hit something like this on Sept 1 no matter what.

Test Plan:
Faked it.

{F135327}

Reviewers: btrahan, csilvers

Reviewed By: csilvers

Subscribers: csilvers, epriestley

Differential Revision: https://secure.phabricator.com/D8625
Support HTTP basic auth in HTTPFuture

Summary: Ref T4590. We already sort of support this for Conduit, push the support a little bit deeper.

Test Plan: Added basic auth across my entire nginx. Requests with no auth or with the wrong auth failed; requests with the right auth worked.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4590

Differential Revision: https://secure.phabricator.com/D8621
Put rel="noreferrer" on all nonlocal links

Summary:
Ref T4342. By default, insert `rel="noreferrer"` for links. We do not insert this if:

  - The caller provided an explicit "rel" attribute.
  - We recognize the link as an anchor ("#comment-2"), or as local to the current domain ("/path/to/resource").

Otherwise, add it in all cases.

Test Plan: Added and executed unit tests. (The javascript stuff which was touched a little bit has a pile of tests already, too.)

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4342

Differential Revision: https://secure.phabricator.com/D8711
Add an "Always Search" flag to the libphutil LDAP adapter

Summary:
Ref T3208. This adds a flag which acts like the old "Search First" flag did, more or less, probably. LDAP?

Specifically, the issue at heart here is that some LDAP servers require totally uncredentialed binds, some require "anonymous" binds (not sure if this is a term of art or if whoever contributed the first LDAP patch made it up), and some require full DN binds. This flag lets us distinguish between the "full DN" and "completely uncredentialed" use cases, both of which have no "anonymous" credentials.

Test Plan: It compiles!

Reviewers: Firehed

Reviewed By: Firehed

Subscribers: epriestley

Maniphest Tasks: T3208

Differential Revision: https://secure.phabricator.com/D8722
Provide slightly better cURL debugging instructions for custom.pem files

Summary: Some context in IRC. We can slightly improve users' chances of catching issues here, maybe.

Test Plan: read it; ran commands

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8740
Support file attachments on HTTPSFuture

Summary: @zeeg wants this for some build stuff and we'd like it in general to make Mailgun work better. It's a bit messy because of how cURL works. See pages of comments inline.

Test Plan:
  - Added tests for the parser stuff.
  - Made various requests with and without file attachments and saw them encode data as expected.
  - Made some dangerous requests (with "@") and saw them fail.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley, zeeg

Differential Revision: https://secure.phabricator.com/D8831
Censor URIs in service profile log

Summary: Mailgun requests can hit a credentialed URI. Censor credentials from `--trace` URIs.

Test Plan: Ran `bin/mail send-test ... --trace` and saw censored credentials.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8833
Latest xhpast for Windows

Summary: This is the latest version of xhpast built from HEAD using MinGW

Test Plan: Ran 'arc liberate' on Windows, it didn't complain about xhpast missing or out of date

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D8843
Make PhutilGitURI and PhutilURI strict about leading whitespace

Summary: Fixes T4913. We silently accept git and normal URIs with leading spaces, but other systems will not accept these. Instead, fail to parse these so they don't get into the system if we're validating URIs.

Test Plan: {F148680}

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4913

Differential Revision: https://secure.phabricator.com/D8897
Make Phobject detect iteration of non-iterable objects

Summary:
See D8914 and IRC. The root issue was that this code:

  foreach ($some_object as $thing) {
    // ...
  }

...means "iterate over the public properties of the object" in PHP, and does not raise any warnings or throw an exception.

This has very nearly bitten me several times too; we //never// want to do this. Instead, throw from objects extending Phobject.

Test Plan:
  - Added and ran unit tests.
  - Tried to foreach() an arbitrary object.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8915
Allow Remarkup lists to have checkboxes

Summary:
Fixes T3945. This provides a convenience style for checkmark lists. They're read-only. See disucssion in T3945.

We're limited on how much we can style the checkboxes -- it would be nice to make them a little more visible, but this seems mostly OK to me. I added some hinting to the item text to make the completion state more clear.

Test Plan:
  - Added unit tests.
  - Ran unit tests.
  - Fixed a couple of existing unit test issues.

{F149711}

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T3945

Differential Revision: https://secure.phabricator.com/D8931
Add piles of special casing to support "mailto:"

Summary: Ref T3949. Bleh.

Test Plan: Unit tests.

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T3949

Differential Revision: https://secure.phabricator.com/D8962
Introduce a quoted reply block rule for Remarkup

Summary:
Ref T4119. The tricky part here is that it's desirable to preserve other block-level formatting elements (like lists, other quotes, etc) inside the block.

To permit that, allow block-level elements to reparse their contents into more block-level elements, and essentially build a parse tree.

The new ReplyBlockRule strips off the ">>!" header and the ">" prefixes, then renders the rest normally, then slaps a blockquote around everything.

I haven't tweaked the styles too much, @chad might have thoughts on that. There should be enough tags/classes to get things rendering pretty flexibly.

I'm probably going to make the normal quote style work like this too (so block-level elements inside it are preserved). A big thing this will help with is inline replies into these blocks. This might imply keeping both quote styles relatively similar.

The selection of ">>!" is arbitrary, but I want some unique marker to indicate the meta/header text. This seemed as good as any.

Test Plan: {F149968}

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: qgil, chad, epriestley

Maniphest Tasks: T4119

Differential Revision: https://secure.phabricator.com/D8953
Make blockquotes use parent/child rules

Summary:
Ref T4119. This makes blockquotes generally work better (lists, code blocks, and other block elements will continue to work inside them). Particularly, it makes inline replies inside of quoted blocks tend to work better.

This changes some edge cases of the semantics slightly, but overall the results should be more reasonable and consistent.

Test Plan: {F149970}

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4119

Differential Revision: https://secure.phabricator.com/D8954