Refactor bookmark import using a generic Netscape parser

[virtualtam]

Relates to #607
Relates to #608
Relates to #493 (abandoned)

Additions:

• use Composer's autoload to load 3rd-party dependencies under vendor/

Modifications:

• [import] replace the current parser with a generic, stable parser
  • move code to application/NetscapeBookmarkUtils
  • improve status report after parsing
• [router] use the same endpoint for both bookmark upload and import dialog
• [template] update bookmark import options
• [tests] ensure bookmarks are properly parsed and imported in the LinkDB
  • reuse reference input from the parser's test data

See:

• https://github.com/shaarli/netscape-bookmark-parser
• https://getcomposer.org/doc/01-basic-usage.md#autoloading

[ArthurHoaro]

The user input should be escaped.

[virtualtam]

should input sanitizing be (optionally) held by the parser, or be left to client code?

[ArthurHoaro]

It should be done by the client. The parser shouldn't know if it needs to be escaped or not (ex: let's say that default tags are retrieve through an ORM which returns escaped data).

[ArthurHoaro]

There is a bug somewhere. I made an import with a similar database, with overwrite and import as private checked. The import ran fine, but my previous private links are now public (and the public ones are private).

EDIT: aside from that and my comment, I'm OK the PR. Nice work with the parser BTW!

[virtualtam]

Yup, still a bit rough around the edges, I still have to add UTs and do more testing :)

[virtualtam]

Not sure for this one; there are various ways of sanitizing inputs & outputs throughout the code. I think the cleanup should be similar to when a new link is added, which corresponds to the following section:

• https://github.com/shaarli/Shaarli/blob/master/index.php#L1245

Apart from tag cleanup, there doesn't seem to be a lot of HTML / special char escaping...

Maybe these operations should be handled by LinkDB to provide a more consistent behaviour?

[ArthurHoaro]

You're right, and I made a mistake on this. We actually sanitize link fields when the DB is retrieved, not when links are added/edited. See https://github.com/shaarli/Shaarli/blob/master/application/LinkDB.php#L290.

I remember doing that, but that doesn't feel like a good idea now. We might want to change that later, maybe in #445. Anyway, it means that you don't have to worry about link fields sanitization here.

[virtualtam]

OK, thanks for the clues ;-)

[virtualtam]

Comments taken into account + test code updated to run with PHP 5.3:

• fix MAX_FILE_SIZE position in the HTML upload form
• add missing @return statements
• redirect to the import page after uploading a file, whatever the import result is
• keep input sanitizing to the bare minimum
• do not use array dereferencing in test code - this harms readability a bit, the concerned tests are quite straightforward though

[virtualtam]

• rebased on Composer: reference shaarli/netscape-bookmark-parser from Packagist #632
• fix default link privacy if missing from the imported file

[virtualtam]

w00t! thanks @ArthurHoaro for the merge :)

[ArthurHoaro]

No problem, thanks for your work on this! =)

[nodiscc]

Thank you all