Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Tie each escaped readme to its own payload
The escaped script tag alone matched either readme, so the markdown
page showing the text readme passed.
| -rwxr-xr-x | tests/t0301-security.sh | 15 |
1 file changed, 7 insertions, 8 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index a9dab52..eeff041 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -67,17 +67,16 @@ test_expect_success 'markdown readme without a filter is escaped as plain text' echo "repo.path=$PWD/repos/sec/.git" && echo "repo.readme=master:readme.txt" } >secreadmerc && - cgit_rc secreadmerc "url=md/about/" >tmp && - grep "pre class=.plaintext." tmp && - grep "<script>" tmp && - ! grep "<script>alert(1)</script>" tmp + cgit_ok secreadmerc "url=md/about/" >tmp && + test_grep "pre class=.plaintext.># Title$" tmp && + test_grep "^<script>alert(1)</script>$" tmp && + test_grep ! "<script>alert(1)</script>" tmp ' test_expect_success 'non-markdown readme without a filter is escaped as plain text' ' - cgit_rc secreadmerc "url=txt/about/" >tmp && - grep "pre class=.plaintext." tmp && - grep "<script>" tmp && - ! grep "<script>alert(2)</script>" tmp + cgit_ok secreadmerc "url=txt/about/" >tmp && + test_grep "pre class=.plaintext.><script>alert(2)</script>$" tmp && + test_grep ! "<script>alert(2)</script>" tmp ' # root-readme is the site's own file rather than repository content, so it |