Repository navigation
fix(attachments): correct base64url encode in render-link hook (#3098) - #3101
Merged
Merged
Conversation
Hugo's `replace` is `replace INPUT OLD NEW`, so the pipe chain `$b64 | replace "+" "-" | replace "/" "_" | replace "=" ""` appended $b64 as the third (NEW) argument at each step, searching the literal "+"/"/"/"=" and discarding the base64 entirely. The emitted attachment-source param collapsed to "u=/=/", which the server base64url-decoded to an invalid URL — ingest failed and every tutorial download link returned 404 "Attachment unavailable" (old and new tutorials alike). Use nested replace() calls with the string as the first positional arg. Add a behavioral regression test that renders the real hook through Hugo and asserts the u= param base64url-decodes back to the exact source URL; the previous string-grep test never rendered Hugo, which is why the bug shipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3098 — tutorial file downloads return
{"error":"Attachment unavailable"}.Root cause
The render-link hook (
hugo/layouts/_default/_markup/render-link.html) base64url-encodes attachment source URLs into the/content/attachment-source?u=param to dodge the Akamai WAF (#1931). It did so with a pipe chain:But Hugo's
replaceisreplace INPUT OLD NEW. Piping appends$b64as the third argument (NEW), so each step becamereplace("+", "-", $b64)— i.e. it searched the literal string"+"and discarded the base64 entirely. The emitted param collapsed to the garbageu=/=/, the server base64url-decoded it to an empty/invalid URL, ingest failed, and the endpoint returned 404 for every download link.This has been broken since the base64url WAF fix (
b82e4bb21) — it never worked, which is why both old (hana-cloud-cap-create-database-cds) and new tutorials are affected.Fix
Use nested
replace()calls with the string as the first positional arg:Test
The old test only string-grepped the template and never rendered Hugo — that's why the bug shipped. Added
test/unit/render-link-attachment-encode.test.ts, which spins up a throwaway Hugo site with the real hook, renders an attachment link, and asserts the emittedu=param base64url-decodes back to the exact source URL (and is free of+///=). Verified failing on the old template, passing on the fix.Deploy note
This is a Hugo-layout change, so it needs a content rebuild to take effect on served tutorials (the
u=param is baked at build time). A full/affected rebuild after merge will regenerate all download links.🤖 Generated with Claude Code