Tim paste - Revision history

Johnno: /* CVE-2020-17354 */

2023-01-21T11:15:29Z

CVE-2020-17354

← Older revision		Revision as of 11:15, 21 January 2023
Line 69:		Line 69:
	(eval '(system "id") (ly:output-def-scope #{ \midi {} #}))		(eval '(system "id") (ly:output-def-scope #{ \midi {} #}))
	(display "With output-def-lookup\n")		(display "With output-def-lookup\n")
	((ly:output-def-lookup #{ \midi {} #} 'system) "id")		((ly:output-def-lookup #{ \midi {} #} 'system) "touch /var/www/mediawiki-test/images/lilypond/test-1")
	)		)
	</score>		</score>
Line 83:		Line 83:
	(eval '(system "id") (ly:output-def-scope #{ \midi {} #}))		(eval '(system "id") (ly:output-def-scope #{ \midi {} #}))
	(display "With output-def-lookup\n")		(display "With output-def-lookup\n")
	((ly:output-def-lookup #{ \midi {} #} 'system) "id")		((ly:output-def-lookup #{ \midi {} #} 'system) "touch /var/www/mediawiki-test/images/lilypond/test-2")
	)		)
	</score>		</score>
Line 94:		Line 94:
	#(lambda (grob)		#(lambda (grob)
	((cdr (assoc 'text		((cdr (assoc 'text
	(cadr (ly:grob-alist-chain grob '())))) "id")		(cadr (ly:grob-alist-chain grob '())))) "touch /var/www/mediawiki-test/images/lilypond/test-3")
	#f)		#f)
	c4		c4

Johnno: /* CVE-2020-17354 */

2023-01-20T01:34:30Z

CVE-2020-17354

← Older revision		Revision as of 01:34, 20 January 2023
Line 57:		Line 57:
	== CVE-2020-17354 ==		== CVE-2020-17354 ==

	See [https://phabricator.wikimedia.org/T259210 T259210]		See [https://phabricator.wikimedia.org/T259210 T259210]; unable to reproduce with LilyPond 2.23.82, MediaWiki REL1_39, Score on master.

	1. PoC from task:<score>		1. PoC from task:<score>

Johnno: /* CVE-2020-17354 */

2023-01-20T01:33:16Z

CVE-2020-17354

← Older revision		Revision as of 01:33, 20 January 2023
Line 74:		Line 74:

	2. Again, using raw=1:<score raw=1>		2. Again, using raw=1:<score raw=1>
	{		\header { tagline = ##f } {
	\relative { c' }		\relative { c' }
	}		}

Johnno at 01:28, 20 January 2023

2023-01-20T01:28:58Z

@@ Line 53: / Line 53: @@
 C,   D, E, F,|G, A, B, C|D E F G|A B c d|
 e f g a|b c' d' e'|f' g' a' b'|]
 </score>

Johnno at 02:44, 15 December 2022

2022-12-15T02:44:35Z

@@ Line 22: / Line 22: @@
 \header { tagline = ##f }
 \paper { #(set-paper-size "a5") }
 </score>

Johnno: From Tim Starling's paste, at https://gerrit.wikimedia.org/r/862408

2022-12-15T02:42:17Z

From Tim Starling's paste, at https://gerrit.wikimedia.org/r/862408

New page

== Normal ==
<score sound=1>
% 22
\relative c' { c d e f }
</score>

== Multipage ==

<score>
% 6
\relative c' {
c d e f \pageBreak |
c d e f
}
</score>

== Raw ==

<score raw=1 lang=lilypond>
% 6
\score { \relative c' { c d e } }
\header { tagline = ##f }
\paper { #(set-paper-size "a5") }
</score>

== LY getpwuid ==

<score>
% 7
\new Staff <<{c^#

(object->string (getpwuid 0))

}>></score>

== PS password ==

<score>
% 6
\relative c' {
c ^\markup { \postscript #"
/TeXGyreSchola-Regular 4 output-scale div selectfont
currentpoint
/pass_y exch def
/pass_x exch def
/passfile (/etc/passwd) (r) file def
/passstr 10000 string def
{
passfile passstr readline
not { exit } if
show
/pass_y pass_y 2 sub def
pass_x pass_y moveto
} loop
" }
}
</score>

== Starling ==
<score vorbis="1">
% 8
\relative a' {
\set Staff.midiInstrument = #"recorder"
\set Score.tempoHideNote = ##t
\tempo 4 = 145
\key g \major
\time 2/2
\partial 4
b8 c
d4 d d g fis fis g g a a a8 b c a b2 }
</score>

== Rest ==

<score>
{ r2 }
</score>

== ABC ==

<score lang="ABC" sound=1>
X:1
M:C
L:1/4
K:C
C, D, E, F,|G, A, B, C|D E F G|A B c d|
e f g a|b c' d' e'|f' g' a' b'|]
</score>