Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check the lone percent sign in the search box
For a bare q=% only the status was checked, so a decoder that dropped
the sign passed.
| -rwxr-xr-x | tests/t0301-security.sh | 9 |
1 file changed, 4 insertions, 5 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index dac5c39..c9f16a5 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -417,11 +417,10 @@ test_expect_success 'a commit with an empty author renders everywhere' ' ' test_expect_success 'a percent sign without digits behind it is read as itself' ' - cgit_rc cverc "url=cve/log/&q=%" >tmp && - grep "^Status: 200" tmp && - cgit_rc cverc "url=cve/log/&q=%zz%2" >tmp && - grep "^Status: 200" tmp && - grep "value=.%zz%2." tmp + cgit_ok cverc "url=cve/log/&q=%" >tmp && + test_grep "name=.q. aria-label=.Search. value=.%.>" tmp && + cgit_ok cverc "url=cve/log/&q=%zz%2" >tmp && + test_grep "name=.q. aria-label=.Search. value=.%zz%2.>" tmp ' test_expect_success 'script in a file name is escaped on the diff page' ' |