Put rel="noreferrer" on all nonlocal links

Summary:
Ref T4342. By default, insert `rel="noreferrer"` for links. We do not insert this if:

  - The caller provided an explicit "rel" attribute.
  - We recognize the link as an anchor ("#comment-2"), or as local to the current domain ("/path/to/resource").

Otherwise, add it in all cases.

Test Plan: Added and executed unit tests. (The javascript stuff which was touched a little bit has a pile of tests already, too.)

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4342

Differential Revision: https://secure.phabricator.com/D8711
Add an "Always Search" flag to the libphutil LDAP adapter

Summary:
Ref T3208. This adds a flag which acts like the old "Search First" flag did, more or less, probably. LDAP?

Specifically, the issue at heart here is that some LDAP servers require totally uncredentialed binds, some require "anonymous" binds (not sure if this is a term of art or if whoever contributed the first LDAP patch made it up), and some require full DN binds. This flag lets us distinguish between the "full DN" and "completely uncredentialed" use cases, both of which have no "anonymous" credentials.

Test Plan: It compiles!

Reviewers: Firehed

Reviewed By: Firehed

Subscribers: epriestley

Maniphest Tasks: T3208

Differential Revision: https://secure.phabricator.com/D8722
Provide slightly better cURL debugging instructions for custom.pem files

Summary: Some context in IRC. We can slightly improve users' chances of catching issues here, maybe.

Test Plan: read it; ran commands

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8740
Support file attachments on HTTPSFuture

Summary: @zeeg wants this for some build stuff and we'd like it in general to make Mailgun work better. It's a bit messy because of how cURL works. See pages of comments inline.

Test Plan:
  - Added tests for the parser stuff.
  - Made various requests with and without file attachments and saw them encode data as expected.
  - Made some dangerous requests (with "@") and saw them fail.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley, zeeg

Differential Revision: https://secure.phabricator.com/D8831
Censor URIs in service profile log

Summary: Mailgun requests can hit a credentialed URI. Censor credentials from `--trace` URIs.

Test Plan: Ran `bin/mail send-test ... --trace` and saw censored credentials.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8833
Latest xhpast for Windows

Summary: This is the latest version of xhpast built from HEAD using MinGW

Test Plan: Ran 'arc liberate' on Windows, it didn't complain about xhpast missing or out of date

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D8843
Make PhutilGitURI and PhutilURI strict about leading whitespace

Summary: Fixes T4913. We silently accept git and normal URIs with leading spaces, but other systems will not accept these. Instead, fail to parse these so they don't get into the system if we're validating URIs.

Test Plan: {F148680}

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4913

Differential Revision: https://secure.phabricator.com/D8897
Make Phobject detect iteration of non-iterable objects

Summary:
See D8914 and IRC. The root issue was that this code:

  foreach ($some_object as $thing) {
    // ...
  }

...means "iterate over the public properties of the object" in PHP, and does not raise any warnings or throw an exception.

This has very nearly bitten me several times too; we //never// want to do this. Instead, throw from objects extending Phobject.

Test Plan:
  - Added and ran unit tests.
  - Tried to foreach() an arbitrary object.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8915
Allow Remarkup lists to have checkboxes

Summary:
Fixes T3945. This provides a convenience style for checkmark lists. They're read-only. See disucssion in T3945.

We're limited on how much we can style the checkboxes -- it would be nice to make them a little more visible, but this seems mostly OK to me. I added some hinting to the item text to make the completion state more clear.

Test Plan:
  - Added unit tests.
  - Ran unit tests.
  - Fixed a couple of existing unit test issues.

{F149711}

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T3945

Differential Revision: https://secure.phabricator.com/D8931
Add piles of special casing to support "mailto:"

Summary: Ref T3949. Bleh.

Test Plan: Unit tests.

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T3949

Differential Revision: https://secure.phabricator.com/D8962
Introduce a quoted reply block rule for Remarkup

Summary:
Ref T4119. The tricky part here is that it's desirable to preserve other block-level formatting elements (like lists, other quotes, etc) inside the block.

To permit that, allow block-level elements to reparse their contents into more block-level elements, and essentially build a parse tree.

The new ReplyBlockRule strips off the ">>!" header and the ">" prefixes, then renders the rest normally, then slaps a blockquote around everything.

I haven't tweaked the styles too much, @chad might have thoughts on that. There should be enough tags/classes to get things rendering pretty flexibly.

I'm probably going to make the normal quote style work like this too (so block-level elements inside it are preserved). A big thing this will help with is inline replies into these blocks. This might imply keeping both quote styles relatively similar.

The selection of ">>!" is arbitrary, but I want some unique marker to indicate the meta/header text. This seemed as good as any.

Test Plan: {F149968}

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: qgil, chad, epriestley

Maniphest Tasks: T4119

Differential Revision: https://secure.phabricator.com/D8953
Make blockquotes use parent/child rules

Summary:
Ref T4119. This makes blockquotes generally work better (lists, code blocks, and other block elements will continue to work inside them). Particularly, it makes inline replies inside of quoted blocks tend to work better.

This changes some edge cases of the semantics slightly, but overall the results should be more reasonable and consistent.

Test Plan: {F149970}

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4119

Differential Revision: https://secure.phabricator.com/D8954
Add WordPress.com OAuth2 plugin

Summary:
This plugin provides an OAuth authentication provider to authenticate users using WordPress.com Connect.

This diff corresponds to the github pull request: https://github.com/facebook/libphutil/pull/36

Test Plan: No test plan, at the moment.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D9004
Minor, update map.
Use the `ArcanistConfigurationDrivenLintEngine` as a linting engine.

Summary: Ref T2039. This diff is the equivalent to D9057, but for rPHU.

Test Plan: Ran `arc lint` and ensure it doesn't complain about the `.arclint` file.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Maniphest Tasks: T2039

Differential Revision: https://secure.phabricator.com/D9063
Add phutil-library linter to libphutil

Summary: Ref T2039. See D9070. D9072 is similar.

Test Plan: Ran `arc lint`.

Reviewers: btrahan, joshuaspence

Reviewed By: joshuaspence

Subscribers: epriestley

Maniphest Tasks: T2039

Differential Revision: https://secure.phabricator.com/D9074
Attempt to automatically build XHPAST.

Summary: Fixes T4951. Whilst `xhpast` was originally intended to be an internal development tool, it is not unreasonable for `ArcanistXHPASTLinter` to be used externally. Currently, however, if the compiled version of `xhpast` is not up-to-date, we simply exit and ask the user to build XHPAST themselves. Instead, let's try to build XHPAST automatically.

Test Plan: Removed `./src/parser/xhpast/bin/xhpast` and ran `arc lint` over a PHP file. Verified that the `xhpast` binary was created during this process.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Maniphest Tasks: T4951

Differential Revision: https://secure.phabricator.com/D9076
Change xdebug.max_nesting_level config after XDebug changes

Summary: Fixes T5027. XDebug has changed how it interprets `0`. See the task or inline for more discussion.

Test Plan:
  - @martin.lindhe confirmed this resolve issues locally.
  - Dug through XDebug to find a root cause for this behavior.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: martin.lindhe, epriestley

Maniphest Tasks: T5027

Differential Revision: https://secure.phabricator.com/D9075
Allow the InRequest key-value cache to have a simple key limit

Summary: Performance of the new graph cache is okay, but pulling data from APC is more expensive than I expected. I'm going to try to tune that by doing some in-request caching, since all requests normally examine the same bucket at first.

Test Plan: Added and executed unit tests.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D9079
Add an `selectDescendantsOfTypes` to the `AASTNode`.

Summary: This method generally seems to make sense (there already exists such a method in the `AASTNodeList` class). Additionally, such a method simplifies D9117 slightly.

Test Plan: Ran the unit tests in rARC, which generally rely on this class.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D9134