Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check the empty author on every page it reaches
The title claimed every page, but only the log, commit and atom pages
were asked for. The commit now changes a file, since the patch page
leaves out a commit with nothing to show, and its parent is read
before the printf, where a failed rev-parse would have gone unnoticed.
| -rwxr-xr-x | tests/t0301-security.sh | 31 |
1 file changed, 22 insertions, 9 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 555eb89..95a31d5 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -370,8 +370,13 @@ test_expect_success 'set up the advisory fixtures' ' printf "x\n" >"\$(touch pwned).c" && git add -A && git commit -m names && - tree=$(git rev-parse HEAD^{tree}) && - printf "tree %s\nparent %s\n" "$tree" "$(git rev-parse HEAD)" >raw && + parent=$(git rev-parse HEAD) && + echo noname >noname.txt && + git add noname.txt && + tree=$(git write-tree) && + git rm -q --cached noname.txt && + rm noname.txt && + printf "tree %s\nparent %s\n" "$tree" "$parent" >raw && printf "author <> 1735689600 +0000\ncommitter <> 1735689600 +0000\n\nempty author\n" >>raw && cid=$(git hash-object --literally -t commit -w raw) && git update-ref refs/heads/noname "$cid" @@ -444,13 +449,21 @@ test_expect_success 'the about page serves nothing above the readme directory' ' ' test_expect_success 'a commit with an empty author renders everywhere' ' - cgit_rc cverc "url=cve/log/&h=noname" >tmp && - grep ">empty author</a>" tmp && - cgit_rc cverc "url=cve/commit/&h=noname" >tmp && - grep "<div class=.commit-subject.>empty author<" tmp && - cgit_rc cverc "url=cve/atom/&h=noname" >tmp && - grep "<name>unknown</name>" tmp && - ! grep "<email></email>" tmp + cgit_ok cverc "url=cve/log/&h=noname" >tmp && + test_grep ">empty author</a>" tmp && + cgit_ok cverc "url=cve/commit/&h=noname" >tmp && + test_grep "<div class=.commit-subject.>empty author<" tmp && + for page in "" refs/ + do + cgit_ok cverc "url=cve/$page" >tmp && + test_grep "<a href=./cve/commit/?h=noname.>empty author</a></td><td class=.col-author.></td>" tmp || return 1 + done && + cgit_ok cverc "url=cve/patch/&h=noname" >tmp && + test_grep "^From: <>$" tmp && + test_grep "^Subject: empty author$" tmp && + cgit_ok cverc "url=cve/atom/&h=noname" >tmp && + test_grep "<name>unknown</name>" tmp && + test_grep ! "<email></email>" tmp ' test_expect_success 'a percent sign without digits behind it is read as itself' ' |