Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test the download names a request chooses
The plain page's header was the only one fed a newline. A snapshot
asked for with h= keeps the name it was requested under, and a blob
fetched by id takes any path, so both put visitor bytes into
Content-Disposition.
| -rwxr-xr-x | tests/t0301-security.sh | 18 |
1 file changed, 18 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 95a31d5..566b852 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -640,4 +640,22 @@ test_expect_success 'request values echoed into a page are escaped' ' ) ' +# With h= or id= given, a snapshot is named as requested rather than worked +# back to a ref, and a blob fetched by id takes whatever path the request +# names, so both reach the Content-Disposition header straight from the +# visitor. +test_expect_success 'a requested download name cannot split the headers' ' + crlf=crlf%0d%0aX-Injected:%201 && + cgit_ok mkrc "url=mk/snapshot/$crlf.tar.gz&h=master" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep "^Content-Type: application/gzip$" headers && + test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.tar.gz.$" headers && + test_grep ! "^X-Injected" headers && + blob=$(git -C repos/mk rev-parse HEAD:file-1) && + cgit_ok mkrc "url=mk/blob/&id=$blob&path=$crlf" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.$" headers && + test_grep ! "^X-Injected" headers +' + test_done |