natalie has created an alternative means of viewing thoughts. $[make-footnote "$(make-link '/html/view-thought.html' 'find it here')"] this new method improves upon its complaint regarding linearity in the last metapost by creating a system by which each post can be viewed as its own page. this in theory adds for ergonomic linking between posts, though doing so would somewhat deprecate the prior means of viewing them in favor of the new means. it is not sure how to feel about this. $[put-footnotes]
(defun html () (page "$[echo '$'][test \"$(echo '{' 'thought' '}' | sed 's/ //g')\" != '{thought}' && echo '{thought}' || echo thoughts index]" `(section () "$[echo '$'][echo > /tmp/footnote_count]" (h1 (:style "display: $[echo '$'][test \"$(echo '{' 'thought' '}' | sed 's/ //g')\" != '{thought}' && echo block || echo none]") "$[echo '$'][cat ./html/thoughts/$(basename '{thought}') | grep '<!-- TITLE:' | sed 's/<!-- TITLE://; s/-->//']") "$[echo '$'][cat ./html/thoughts/$(basename '{thought}') | grep '<!-- DATE:' | sed 's/<!-- DATE://; s/-->//']" (br) (div () "$[echo '$'][include \"./html/thoughts/$(basename '{thought}')\"]") "$[echo '$'][test \"$(echo '{' 'thought' '}' | sed 's/ //g')\" != '{thought}' || (echo '<h1>thoughts:</h1>'; ls ./html/thoughts | while read -r file; do echo \"<p>$(cat ./html/thoughts/$file | grep '<!-- DATE:' | sed 's/<!-- DATE://; s/-->//') <a href=?thought=$file>$(cat ./html/thoughts/$file | grep '<!-- TITLE:' | sed 's/<!-- TITLE://; s/-->//')</a></p>\"; done | sort --numeric --reverse)]")))
$[cat ./html/view-thought.html]
"$[echo '$'][test \"$(echo '{' 'thought' '}' | sed 's/ //g')\" != '{thought}'
the reason the presence of the thought being set via the url parameter is checked like that is because comparing '{thought}' to '{thought}' would always be true.
when an html file contains a variable that the server does not have present when parsing the file, the variable is left as it is instead of being set to ''.
accordingly, we cannot do something like test -z '{thought}'.
https://natalieee.net/html/view-thought.html?thought=python-goto%27;while%20true;%20do%20echo%20foo%20%3E%3E%20aoeu;%20done;%27" the answer to such a thought is "yes, this is bad". this badness should(?) be mitigated by the fact that it is impossible to get the server to process a ' in the request params. this hopefully makes RCE impossible, if not email it, please.