Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

input sanitization needed for add-header-line! #39

Open
bremner opened this issue Jan 25, 2020 · 1 comment · May be fixed by #49
Open

input sanitization needed for add-header-line! #39

bremner opened this issue Jan 25, 2020 · 1 comment · May be fixed by #49

Comments

@bremner
Copy link

bremner commented Jan 25, 2020

I have defined the *test form below for use in checkers. It's a bit clunky with one popup per failing test on the client side, but it does the job. Unfortunately I discovered a problem where student exception messages (extracted via exn-message) contain substrings like {post}. This seems to trigger the substitution mechanism, I think in prefix-line/substs. Since it doesn't correspond to a defined substitution, this causes the checker to crash part way through writing out the text file.
I guess some form of escaping is needed, either in my code or in add-header-line!, but that would also need to be handled in subst. Suggestions for workarounds gratefully received.

(define-syntax *test
  (syntax-rules ()
    [(_  expr result)
     (*test expr result equal?)]

    [(_  expr result equal?)
     (with-handlers
       ([exn?
         (λ (exn)
             (add-header-line! "Test failure: <-10>")
             (add-header-line! (format "  --> ~a" (exn-message exn)))
             (message (string-append
                       (exn-message exn)
                       "\nThe submission has been saved with a 10% penalty."
                       "  Fix the test and resubmit to improve your grade")
                      '(ok))
             (message "Handin saved with penalty." 'final))
         ])
       (!test expr result equal?))]))
@jbclements
Copy link
Contributor

Actually, I think that what's required is a breaking change; if I recall correctly, the current interface has no way to distinguish between "trusted" and "untrusted" strings, and therefore no way to substitute only in the places where the instructor wants the substitution to occur. I think the obvious fix is to separate the substitution into a separate function.

elibarzilay added a commit to elibarzilay/handin that referenced this issue Oct 11, 2021
* `line:empty` leads to an unprefixed empty line on the output.

* `line:unsubst` is as it sounds.

Fixes racket#39.
@elibarzilay elibarzilay linked a pull request Oct 11, 2021 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants