Score testing - Revision history

Johnno: /* CVE-2020-17354 */

2023-01-20T02:36:49Z

CVE-2020-17354

Johnno: /* CVE-2020-17354 */

2023-01-20T02:26:44Z

CVE-2020-17354

Johnno: /* CVE-2020-17354 */

2023-01-20T02:25:42Z

CVE-2020-17354

Johnno: /* CV-2020-17354 */

2023-01-20T02:22:59Z

CV-2020-17354

Johnno at 01:40, 20 January 2023

2023-01-20T01:40:24Z

Johnno: /* CV-2020-17354 */

2023-01-20T01:28:19Z

CV-2020-17354

Johnno at 22:20, 19 January 2023

2023-01-19T22:20:55Z

Johnno at 22:19, 19 January 2023

2023-01-19T22:19:10Z

Johnno at 22:15, 19 January 2023

2023-01-19T22:15:11Z

Johnno at 20:46, 19 January 2023

2023-01-19T20:46:28Z

@@ Line 50: / Line 50: @@
 == CVE-2020-17354 ==
-See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like this has been fixed (assuming we're supposed to see the system id in the rendered music); can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_35 and Score on master.
+See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like this has been fixed (assuming we're supposed to see the system id in the rendered music); can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_35 and Score on REL1_35.
 . PoC from task: <score raw=1> \header { tagline = ##f }

@@ Line 50: / Line 50: @@
 == CVE-2020-17354 ==
-See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like this has been fixed (assuming we're supposed to see the system id in the rendered music); can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_39 and Score on master.
+See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like this has been fixed (assuming we're supposed to see the system id in the rendered music); can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_35 and Score on master.
 . PoC from task: <score raw=1> \header { tagline = ##f }

@@ Line 50: / Line 50: @@
 == CVE-2020-17354 ==
-See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like either the syntax of the vuln PoC needs updating, and/or they've been fixed. Can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_39 and Score on master.
+See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like this has been fixed (assuming we're supposed to see the system id in the rendered music); can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_39 and Score on master.
 . PoC from task: <score raw=1> \header { tagline = ##f }

@@ Line 48: / Line 48: @@
 </score>
-== CV-2020-17354 ==
+== CVE-2020-17354 ==
 See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like either the syntax of the vuln PoC needs updating, and/or they've been fixed. Can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_39 and Score on master.

@@ Line 50: / Line 50: @@
 == CV-2020-17354 ==
-See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like either the syntax of the vuln PoC needs updating, and/or they've been fixed. Can't repro as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_39 and Score on master.
+See [https://phabricator.wikimedia.org/T259210 T259210]. Looks like either the syntax of the vuln PoC needs updating, and/or they've been fixed. Can't reproduce as currently stands, with LilyPond 2.19 (Buster), MediaWiki on REL1_39 and Score on master.
-. With defined location: <score raw=1>
+. PoC from task: <score raw=1> \header { tagline = ##f }
+{
    \relative { c' }
@@ Line 66: / Line 66: @@
 </score>
-. and without: <score raw=1>
+. Notehead stencil hack PoC, contributed in [https://phabricator.wikimedia.org/T259210#6368852 comment] from LilyPond developer Han-wen Nienhuys: <score raw=1> \header { tagline = ##f }
+{
    \override NoteHead.text = \system
    \override NoteHead.stencil =

@@ Line 1: / Line 1: @@
 [[File:Score_PNG_output_in_dark_theme.png|thumb|Unreadable Score extension output in dark mode]]
 Hopefully I can get the Score extension working to produce SVG output on upstream task [https://phabricator.wikimedia.org/T49578 T49578]. The transparent PNG image normally produced needs white background styling otherwise it's unreadable in dark mode.
-;Update December 2022: my patch was merged! :) now we wait for it to be tested and deployed into Wikipedia. There are a few other issues, including some security and sandboxing concerns, e.g. CVE-2020-17354 (see below). Also, this wiki is running on a 32-bit server, which only supports up to LilyPond 2.22 (I'm not game enough to try and compile LilyPond myself, and I'm not even sure Scheme 2 runs in 32-bit?) So I'm testing the SVG Score output over on my [https://mw-master.test.jon.geek.nz test instance] (which is not guaranteed to be up at all times).
+;Update December 2022: my patch was merged! :) now we wait for it to be tested and deployed into Wikipedia. There are a few other issues, including some security and sandboxing concerns, e.g. CVE-2020-17354 (see below). Also, this wiki is running on a 32-bit Debian 10 (Buster), which has LilyPond 2.19 (32 bit builds not supported after 2.22). I'm not game enough to try and compile LilyPond myself, and I'm not even sure Scheme 2 runs in 32-bit(?) so I'm testing the SVG Score output over on my [https://mw-master.test.jon.geek.nz test instance] (which is not guaranteed to be up at all times).
 == Examples ==