From 6bd741bd512904dfec7c1aa2b7b2bd3dd4269681 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Wed, 19 Aug 2026 09:53:37 +0200 Subject: fix(cli): guard the whole template read, not only the open read_file guarded open_in_bin but left in_channel_length and really_input_string unguarded, so a path that opens but cannot be read as bytes -- a directory -- escaped as an uncaught Sys_error and crashed the program, leaking the open channel on every failure path. A template is user input; it must never crash the program. Wrap the whole read in Fun.protect so the channel closes on every path (success, exception, early return), matching the close-on-every-path pattern already used in the test suite. The missing-file message stays exactly as before; a read failure after a successful open now carries the exception text, the same path: exception shape Layer.load and Overlay.load already use. New cram case points --template at a directory (the sandbox's own cwd, not /tmp) and asserts one stderr line and exit 2, not a crash. --- test/cli.t | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'test') diff --git a/test/cli.t b/test/cli.t index 73eefc1..c5aeb98 100644 --- a/test/cli.t +++ b/test/cli.t @@ -537,6 +537,15 @@ A missing template file is an error: colitur: cannot read template /tmp/nope.txt [2] +Pointing --template at a directory is an error, not a crash: the read +itself is guarded, not only the open (F1, fix round 1). "." is used rather +than a fixed /tmp path so this does not depend on anything outside the +cram sandbox itself: + + $ colitur table --year 2027 --template . --flavour none + colitur: cannot read template .: Sys_error("Value too large for defined data type") + [2] + table and render both require --year and --template: $ colitur table --year 2027 -- cgit v1.3