luci-base: fix auth plugin asset loading

[FuSan21]

normalize_assets() builds its path pattern with sprintf() and hands the resulting string to match(). ucode's match() only accepts a regexp:

if (ucv_type(pattern) != UC_REGEXP || !subject)
	return NULL;

It returns null whatever the subject is, !match(...) is therefore always true, and every asset is dropped by the continue under it. As far as I can tell no auth plugin has ever had its scripts rendered on the login page since the mechanism was added in 4a308ba.

It fails silently, which makes it unpleasant to track down. The html from the same check() result is unaffected, so the plugin's login UI renders normally but without the script that drives it, and nothing is logged. plugins/luci-plugin-auth-example declares assets too, so the shipped example is affected as well.

Reproducer:

$ ucode -e 'print(match("/a/b", "^/a/") ? "MATCH" : "NULL", "\n")'
NULL
$ ucode -e 'print(match("/a/b", /^\/a\//) ? "MATCH" : "NULL", "\n")'
MATCH

The check is a plain prefix test, so the first commit uses index() rather than compiling a regexp inside the loop. It returns the offset of the first occurrence or -1, which makes != 0 the equivalent of the anchored ^, and it matches the existing idiom at http.uc:397.

The second commit is a follow-up from review. Because this series is what makes normalize_assets() return a non-empty result for the first time, the surviving src now reaches <script src="{{ asset.src }}"></script> unescaped in all three in-tree sysauth templates (luci-base, bootstrap, footstrap). The existing filter rejects .. and whitespace but not quotes or angle brackets, so a src ending x.js"></script><script>... would close the attribute — no whitespace required. normalize_assets() is the single point every theme passes through, so the rejected character class is widened there rather than escaping in each template, which also covers out-of-tree themes carrying the same markup.

Found while getting a third-party WebAuthn auth plugin working. Verified on qualcommax/ipq807x with luci-base 26.234.21935: auth_assets arrives empty at the login template and no <script> tag is emitted, and correcting the path check makes the tag render and the passkey login complete.

[openwrt-ai]

The diagnosis checks out. uc_match() bails with if (ucv_type(pattern) != UC_REGEXP || !subject) return NULL; (lib.c:3224), so the string pattern made the check unconditionally false and every asset was dropped. plugin.uuid is indeed only assigned after match(uuid, /^[a-f0-9]{32}$/) passes during load(), so the interpolation-safety claim holds, and regexp() is a core builtin available under 'use strict'. This was also the only match() call in the tree passing a non-regexp pattern, so no sibling instances need the same fix.

Two inline notes, neither blocking.

---

Generated by Claude Code

[openwrt-ai]

Both notes from the previous round are addressed.

The index() switch is correct and is the in-tree idiom for a prefix test. The widened character class parses as intended — inside a regexp literal ucode's lexer reads a bracket expression through to the closing ] and pushes ", ' and ` verbatim (lexer.c:400-412), so no escaping is needed there. Filtering in normalize_assets() rather than in the templates is the right call: all three in-tree sysauth templates (modules/luci-base/ucode/template/sysauth.ut:67, themes/luci-theme-bootstrap/.../sysauth.ut:52, themes/luci-theme-footstrap/.../sysauth.ut:134) carry the same unescaped src="{{ asset.src }}", and out-of-tree themes copying that markup are covered for free. With <, >, ", ' and backtick rejected, the attribute-breakout payload from the earlier round no longer survives, and the fixed /luci-static/plugins/<uuid>/ prefix rules out scheme-based src values.

Both commit messages match their diffs. One nit inline about the PR description having drifted from the code.

---

Generated by Claude Code