shortcodeparser: fix panic on slash following opening shortcode comment

Fixes #1093

diff --git a/hugolib/page.go b/hugolib/page.go
index 6dfd3eea82373ccc0e4574a1ddb1f5e6b2bfa377..e53781b64eb3a82ffad7dc9f35eee1305f26bfab 100644 (file)
--- a/hugolib/page.go
+++ b/hugolib/page.go
@@ -752,7 +752,7 @@ func (p *Page) ProcessShortcodes(t tpl.Template) {
 
        // these short codes aren't used until after Page render,
        // but processed here to avoid coupling
-       tmpContent, tmpContentShortCodes := extractAndRenderShortcodes(string(p.rawContent), p, t)
+       tmpContent, tmpContentShortCodes, _ := extractAndRenderShortcodes(string(p.rawContent), p, t)
        p.rawContent = []byte(tmpContent)
        p.contentShortCodes = tmpContentShortCodes
 

diff --git a/hugolib/shortcode.go b/hugolib/shortcode.go
index 722c86db0c884bff4cd14986991e654570ee62a0..2a973f99b654d85360c4704c45f2c271caea707f 100644 (file)
--- a/hugolib/shortcode.go
+++ b/hugolib/shortcode.go
@@ -125,7 +125,11 @@ func (sc shortcode) String() string {
 // HandleShortcodes does all in  one go: extract, render and replace
 // only used for testing
 func HandleShortcodes(stringToParse string, page *Page, t tpl.Template) (string, error) {
-       tmpContent, tmpShortcodes := extractAndRenderShortcodes(stringToParse, page, t)
+       tmpContent, tmpShortcodes, err := extractAndRenderShortcodes(stringToParse, page, t)
+
+       if err != nil {
+               return "", err
+       }
 
        if len(tmpShortcodes) > 0 {
                tmpContentWithTokensReplaced, err := replaceShortcodeTokens([]byte(tmpContent), shortcodePlaceholderPrefix, true, tmpShortcodes)
@@ -236,7 +240,7 @@ func renderShortcode(sc shortcode, p *Page, t tpl.Template) string {
        return renderShortcodeWithPage(tmpl, data)
 }
 
-func extractAndRenderShortcodes(stringToParse string, p *Page, t tpl.Template) (string, map[string]string) {
+func extractAndRenderShortcodes(stringToParse string, p *Page, t tpl.Template) (string, map[string]string, error) {
 
        content, shortcodes, err := extractShortcodes(stringToParse, p, t)
        renderedShortcodes := make(map[string]string)
@@ -255,7 +259,7 @@ func extractAndRenderShortcodes(stringToParse string, p *Page, t tpl.Template) (
                }
        }
 
-       return content, renderedShortcodes
+       return content, renderedShortcodes, err
 
 }
 

diff --git a/hugolib/shortcode_test.go b/hugolib/shortcode_test.go
index e583a5ce33654e2b2e4bdc7c3c4e39f3ab1380af..742a02ffe21945cd2298bd6dd620553eb80a7793 100644 (file)
--- a/hugolib/shortcode_test.go
+++ b/hugolib/shortcode_test.go
@@ -31,6 +31,35 @@ func CheckShortCodeMatch(t *testing.T, input, expected string, template tpl.Temp
        }
 }
 
+func TestShortcodeGoFuzzReports(t *testing.T) {
+       tem := tpl.New()
+
+       tem.AddInternalShortcode("sc.html", `foo`)
+       p, _ := pageFromString(SIMPLE_PAGE, "simple.md")
+
+       for i, this := range []struct {
+               data      string
+               expectErr bool
+       }{
+               {"{{</*/", true},
+       } {
+               output, err := HandleShortcodes(this.data, p, tem)
+
+               if this.expectErr && err == nil {
+                       t.Errorf("[%d] should have errored", i)
+               }
+
+               if !this.expectErr && err != nil {
+                       t.Errorf("[%d] should not have errored: %s", i, err)
+               }
+
+               if !this.expectErr && err == nil && len(output) == 0 {
+                       t.Errorf("[%d] empty result", i)
+               }
+       }
+
+}
+
 func TestNonSC(t *testing.T) {
        tem := tpl.New()
        // notice the syntax diff from 0.12, now comment delims must be added

diff --git a/hugolib/shortcodeparser.go b/hugolib/shortcodeparser.go
index 5621a382f81b7f93148c27c837c842f1a5dbee18..2efebbe4b3acb1c50c47dec9ef4b0d98753f6851 100644 (file)
--- a/hugolib/shortcodeparser.go
+++ b/hugolib/shortcodeparser.go
@@ -325,7 +325,7 @@ func lexShortcodeLeftDelim(l *pagelexer) stateFunc {
 
 func lexShortcodeComment(l *pagelexer) stateFunc {
        posRightComment := strings.Index(l.input[l.pos:], rightComment)
-       if posRightComment < 0 {
+       if posRightComment <= 1 {
                return l.errorf("comment must be closed")
        }
        // we emit all as text, except the comment markers