From 4de7f7dca7485c9a6c94f6f86a53d01a974fce54 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Thu, 23 Jul 2026 14:39:31 +0200 Subject: web: HTMX server + lectio-web binary NewServer wires B1's RenderReadings/Themes/themeCSS/embedded static+ templates FS into an http.ServeMux: GET / (full page), GET /readings (HTMX reading-pane fragment), GET /lookup (bible.Lookup passage search fragment), GET /theme.css (theme stylesheet, falling back through cfg.WebTheme to the built-in default on an unknown name), GET /static/. Run listens on cfg.WebPort (0 = OS-picked free port), prints the URL, best-effort opens a browser, then serves. cmd/lectio-web is the binary entry point (config.Load -> web.Run). Fold-in from the B1 review: hardened themeCSS's name guard to an explicit ^[A-Za-z0-9_-]+$ allowlist (the old filepath.Base/ContainsAny check let ".." through), plus guard-rejection and HTML-escaping regression tests -- B2 is what makes /theme.css?name= reachable from the network, so it owns closing this out. --- internal/web/render.go | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'internal/web/render.go') diff --git a/internal/web/render.go b/internal/web/render.go index cf72d41..67c7a37 100644 --- a/internal/web/render.go +++ b/internal/web/render.go @@ -130,14 +130,21 @@ func Themes() []string { return names } +// themeNameRe is the allowlist a theme name must match: letters, digits, +// underscore, hyphen only. Legitimate theme stems (built-in or user) already +// fit this shape; it is deliberately stricter than "no path separators" so +// it rejects "." / ".." / any other filesystem metacharacter outright +// instead of trying to enumerate what's unsafe. +var themeNameRe = regexp.MustCompile(`^[A-Za-z0-9_-]+$`) + // themeCSS returns one theme's CSS: the user file // ${XDG_CONFIG_HOME:-~/.config}/lectio/themes/.css if it exists, // otherwise the embedded static/themes/.css, otherwise an error. -// name must be a bare file stem (no path separators or "..") -- callers -// (B2's /theme.css?name= handler) pass this straight through from an HTTP -// query parameter, so this rejects path traversal rather than trusting it. +// name must match themeNameRe -- callers (B2's /theme.css?name= handler) +// pass this straight through from an HTTP query parameter, so this rejects +// path traversal rather than trusting it. func themeCSS(name string) ([]byte, error) { - if name == "" || name != filepath.Base(name) || strings.ContainsAny(name, `/\`) { + if !themeNameRe.MatchString(name) { return nil, fmt.Errorf("web: invalid theme name %q", name) } -- cgit v1.3