From 0de9ed10352a5910f9ef2909116c30c91eedac7f Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 11:12:41 -1000 Subject: Give the harness cgit's print and its other sinks Lua's own print wrote outside the collected output, so a stray print in a filter passed every check while under cgit it lands on the page. html_url_arg and html_include were missing, which only a filter using them would have found. --- tests/extensions/harness.lua | 37 +++++++++++++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-) (limited to 'tests/extensions/harness.lua') diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua index 188d90f..86f09a6 100644 --- a/tests/extensions/harness.lua +++ b/tests/extensions/harness.lua @@ -47,12 +47,45 @@ html_attr = sink(function(s) end) -- The bytes url_escape_table encodes, which are those a url path cannot --- carry plainly and those an attribute or a query would misread. +-- carry plainly and those an attribute or a query would misread. A query +-- argument spells a space as a plus. +local url_escapes = "[%c \"#%%&'+<=>?\\^`{|}\128-\255]" + html_url_path = sink(function(s) - return (s:gsub("[%c \"#%%&'+<=>?\\^`{|}\128-\255]", function(c) + return (s:gsub(url_escapes, function(c) return string.format("%%%02X", c:byte()) end)) end) +html_url_arg = sink(function(s) + return (s:gsub(url_escapes, function(c) + return c == " " and "+" or string.format("%%%02X", c:byte()) + end)) +end) + +-- html_include copies a file into the page as it is, and a file it cannot +-- open costs a line in the error log instead. +html_include = sink(function(filename) + local file, message, code = io.open(filename, "rb") + if not file then + io.stderr:write("[cgit] Unable to include ", filename, ": ", + message:match("^.-: (.*)$") or message, " (", tostring(code), ")\n") + return "" + end + local contents = file:read("*a") + file:close() + return contents +end) + +-- cgit's print builds the line Lua's own would, each value through tostring +-- with a tab between them, and writes it as html does, so a stray print +-- lands on the page and not beside it. +print = function(...) + local parts = {} + for i = 1, select("#", ...) do + parts[i] = tostring((select(i, ...))) + end + html(table.concat(parts, "\t") .. "\n") +end -- What a script writes to standard error goes to the web server's error log -- under cgit, so it is kept here for a check to read instead. -- cgit 2.12.1