Files
felhom.eu/documentation/audits/i18n-slice2-2026-09-18/B/live/probeB3.sh
T
admin 08e9ddbd5c
gates / gates (push) Successful in 25s
docs: localisation slice 2 release B (controller v0.253.0) — R-557 progress, R-575, R-576
All 179 Hungarian error messages carry a key; zero remain. 10-localisation.md gains §10.2: the
four properties util.MsgError had to have at once and the failure each one prevents, and the
plural rule as a BUNDLE rule rather than a per-call-site flag, with the answerable sentence and
what the other option would have cost.

Two instrument defects recorded rather than tidied away, because both shapes recur:

R-576 — the parity gate has a measured blind spot. The bulk converter dropped the continuation
of multi-line concatenations, damaging 7 producers, and the gate stayed GREEN: every surviving
fragment WAS a byte-equal base-commit literal, so its question ("is this text real?") was
answered yes while the CALL had lost half its sentence. Two behaviour tests caught it. The
general form: a structural gate over the TEXT cannot see a defect in the CALL.

And the script counting what was left was case-sensitive, so it said "0 remain" while five did —
R-565's shape inside the measurement. Every "no Hungarian left" claim in this slice is now made
case-insensitively and with both controls.

R-575 — the soft memory-overcommit warning has no error to carry a key and no language where it
is built, so it renders Hungarian on an English page. Named in the code, not hidden.

Live evidence includes a mistake I made and corrected: a probe of the deploy refusal INSTALLED
vaultwarden on demo-hp (the endpoint accepts before it validates), the same mistake the previous
session recorded. Removed through the product's own path with its data; verified gone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-18 11:51:06 +02:00

35 lines
2.2 KiB
Bash

#!/bin/bash
# Release B, the sentence AS RENDERED. Every request is refused by a validator that runs before any
# mutation; the redirect is then FOLLOWED so what is read is what the customer sees on the page.
IP=172.17.0.2:8080
H="Host: felhom.enkisfelhom.hu"
PW=$(cat /tmp/.felhompw); J=/tmp/pj.txt; rm -f $J
curl -s -c $J -H "$H" "http://$IP/login" -o /tmp/lg.html
CSRF=$(grep -o 'name="_csrf" value="[^"]*"' /tmp/lg.html | head -1 | sed 's/.*value="//;s/"//')
SESS=$(curl -s -b $J -H "$H" -D - -o /dev/null -X POST "http://$IP/login" --data-urlencode "password=$PW" --data-urlencode "_csrf=$CSRF" | grep -i '^set-cookie: felhom_session' | head -1 | sed 's/[Ss]et-[Cc]ookie: //;s/;.*//')
[ -z "$SESS" ] && { echo "LOGIN FAILED"; exit 1; }
curl -s -H "$H" -H "Cookie: $SESS" "http://$IP/sharing" > /tmp/sp.html
SC=$(grep -o 'name="_csrf" value="[^"]*"' /tmp/sp.html | head -1 | sed 's/.*value="//;s/"//')
echo "LOGIN OK"
# $1 label, $2 form args...
try(){ local label="$1"; shift
for L in hu en; do
LOC=$(curl -s -H "$H" -H "Cookie: $SESS" --max-time 12 -o /dev/null -w "%{redirect_url}" \
-X POST "http://$IP/sharing/shares" --data-urlencode "_csrf=$SC" "$@")
# the URL the browser is sent to, then the page as it renders it
Q=$(echo "$LOC" | sed 's|.*/sharing?||')
TXT=$(curl -s -H "$H" -H "Cookie: $SESS" --max-time 12 "http://$IP/sharing?${Q}&lang=$L" \
| grep -o 'alert alert-success">[^<]*' | head -1 | sed 's/.*">//')
printf " %-34s %s -> %s\n" "$label" "$L" "$TXT"
done
}
try "share name with a slash" --data-urlencode "name=bad/name" --data-urlencode "path=/tmp"
try "share name empty" --data-urlencode "name=" --data-urlencode "path=/tmp"
try "share name too long (>15)" --data-urlencode "name=aaaaaaaaaaaaaaaaaaaa" --data-urlencode "path=/tmp"
try "share name starts with _" --data-urlencode "name=_reserved" --data-urlencode "path=/tmp"
echo "--- and the legacy case: a URL an OLD controller minted, carrying prose ---"
for L in hu en; do
TXT=$(curl -s -H "$H" -H "Cookie: $SESS" --max-time 12 "http://$IP/sharing?flash=Be%C3%A1ll%C3%ADt%C3%A1s+mentve.&lang=$L" | grep -o 'alert alert-success">[^<]*' | head -1 | sed 's/.*">//')
printf " %-34s %s -> %s\n" "legacy prose in the URL" "$L" "$TXT"
done