Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Look for inline handlers on every main page
Only the commit page was checked, and only for onchange, though a site
policy without unsafe-inline blocks every inline handler on any page.
| -rwxr-xr-x | tests/t0301-security.sh | 19 |
1 file changed, 15 insertions, 4 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index eeff041..64129b6 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -97,12 +97,23 @@ test_expect_success 'root-readme without a filter is its own page, as written' ' # A Content-Security-Policy without unsafe-inline stops an inline onchange # handler from ever running, so the option form submits through a plain -# button and its selects carry no handlers at all. +# button and its selects carry no handlers at all, and nor does any other +# page. test_expect_success 'diff options submit through a button' ' sha=$(git -C repos/foo rev-parse HEAD) && - cgit_url "foo/commit&id=$sha" >tmp && - grep "type=.submit. value=.reload." tmp && - ! grep "onchange" tmp + cgit_ok_url "foo/commit&id=$sha" >tmp && + test_grep "type=.submit. value=.reload." tmp && + test_grep ! " on[a-z]*=" tmp +' + +test_expect_success 'no page carries an inline handler' ' + for page in repolist: summary:foo/ log:foo/log/ tree:foo/tree/ diff:foo/diff/ \ + refs:foo/refs/ + do + cgit_ok_url "${page#*:}" >tmp && + test_grep "data-page=.${page%%:*}." tmp && + test_grep ! " on[a-z]*=" tmp || return 1 + done ' # Grouping directories ahead of files is behaviour this fork adds, so nothing |