github/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2024-11-21 20:46:30 -05:00
Code Issues Projects Releases Packages Wiki Activity

Avoid panic in shortcode param handling

Browse source 
Fixes #1337
This commit is contained in:
Bjørn Erik Pedersen 2015-08-07 20:08:23 +02:00
parent 35bb72c83e
commit 0f1fb8c7d8
2 changed files with 32 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
hugolib/shortcode.go
View file

@ -271,6 +271,8 @@ func extractAndRenderShortcodes(stringToParse string, p *Page, t tpl.Template) (
}
var shortCodeIllegalState = errors.New("Illegal shortcode state")
// pageTokens state:
// - before: positioned just before the shortcode start
// - after: shortcode(s) consumed (plural when they are nested)
@ -353,8 +355,12 @@ Loop:
params[currItem.val] = pt.next().val
sc.params = params
} else {
params := sc.params.(map[string]string)
if params, ok := sc.params.(map[string]string); ok {
params[currItem.val] = pt.next().val
} else {
return sc, shortCodeIllegalState
}
}
} else {
// positional params
@ -363,9 +369,13 @@ Loop:
params = append(params, currItem.val)
sc.params = params
} else {
params := sc.params.([]string)
if params, ok := sc.params.([]string); ok {
params = append(params, currItem.val)
sc.params = params
} else {
return sc, shortCodeIllegalState
}
}
}

18
hugolib/shortcode_test.go
View file

@ -18,14 +18,22 @@ func pageFromString(in, filename string) (*Page, error) {
}
func CheckShortCodeMatch(t *testing.T, input, expected string, template tpl.Template) {
CheckShortCodeMatchAndError(t, input, expected, template, false)
}
func CheckShortCodeMatchAndError(t *testing.T, input, expected string, template tpl.Template, expectError bool) {
p, _ := pageFromString(SIMPLE_PAGE, "simple.md")
output, err := HandleShortcodes(input, p, template)
if err != nil {
if err != nil && !expectError {
t.Fatalf("Shortcode rendered error %s. Expected: %q, Got: %q", err, expected, output)
}
if err == nil && expectError {
t.Fatalf("No error from shortcode")
}
if output != expected {
t.Fatalf("Shortcode render didn't match. got %q but exxpected %q", output, expected)
}
@ -91,6 +99,14 @@ func TestPositionalParamIndexOutOfBounds(t *testing.T) {
CheckShortCodeMatch(t, "{{< video 47238zzb >}}", "Playing Video error: index out of range for positional param at position 1", tem)
}
// some repro issues for panics in Go Fuzz testing
func TestShortcodeGoFuzzRepros(t *testing.T) {
tt := tpl.New()
tt.AddInternalShortcode("inner.html", `Shortcode... {{ with .Get 0 }}{{ . }}{{ end }}-- {{ with .Get 1 }}{{ . }}{{ end }}- {{ with .Inner }}{{ . }}{{ end }}`)
// Issue #1337
CheckShortCodeMatchAndError(t, "{{%inner\"\"\"\"=\"\"", "", tt, true)
}
func TestNamedParamSC(t *testing.T) {
tem := tpl.New()
tem.AddInternalShortcode("img.html", `<img{{ with .Get "src" }} src="{{.}}"{{end}}{{with .Get "class"}} class="{{.}}"{{end}}>`)