| Age | Commit message (Collapse) | Author | Lines |
|
A short object name was checked only for a missing anchor, and the
value that passes through untouched never held the entities cgit
escapes it with, so escaping it again would have passed.
|
|
The avatar checks held a 40000 byte address to half a second, twenty
times tighter than the readme budget that already failed on a slow
host, and in stub mode nearly all of that time went on the fake digest.
Link-commits and link-trailers had no check on a long input at all. The
readme checks' method moves into the harness so all four share it.
A single timing of each length let a busy host that took the CPU away
during the longer one make a linear pass look quadratic. The lengths
now take turns and the fastest timing of each counts, since a busy host
can slow one timing but rarely all five. A ratio under six ends the
turns at once, so only one near the bound of ten waits for all five.
|
|
Skipping a malformed rule, a rule without a key, the switch for bare
urls and the shipped CVE example were untested, and the only url kept
from linking was one holding a quote, so a broader scheme check would
have let javascript:// through.
|
|
Where a standalone Lua had no lpeg, the harness skipped the markdown
and man checks itself, behind a note the test library hides, and the
test passed on the six checks left. The real luaossl checks were left
out the same way. Each now shows as a skip under a prerequisite named
for the interpreter, and a misspelt mode fails rather than running the
default.
|
|
As in link-commits, every capture was hex or digits. A string
replacement there would also raise outside the pcall that guards the
pattern and take the whole page down.
|
|
An unedited copy sent every #123, Closes: and Bug: mark to
bugs.example.com, a link that is wrong for every site.
|
|
|