Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Feed the Location header every kind of byte
Only a benign query had been redirected, so nothing showed that a
space, a control byte or a byte past ASCII in the query string is
encoded before it reaches the Location header.
| -rwxr-xr-x | tests/t0301-security.sh | 13 |
1 file changed, 13 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 566b852..a00ded2 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -658,4 +658,17 @@ test_expect_success 'a requested download name cannot split the headers' ' test_grep ! "^X-Injected" headers ' +# The about page of a repository without a readme sends the visitor on to +# the summary with the query string as it arrived, which a server hands over +# undecoded, so a byte no header line may carry is encoded on the way out. +test_expect_success 'a redirect keeps every query byte inside its Location' ' + cgitrc_copy redirectrc && + query=$(printf "x=a b\tc\r\nX-Injected: 1&y=\303\251\177") && + cgit_rc redirectrc "url=foo/about&$query" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep "^Status: 302" headers && + test_grep "^Location: /foo/?x=a%20b%09c%0D%0AX-Injected:%201&y=%C3%A9%7F$" headers && + test_grep ! "^X-Injected" headers +' + test_done |