Check the site readme and a repository without one

The site readme reaches about-render with no tree, where only the
scheme check stands between a javascript: link and the page, and no
test rendered one. The redirect for a repository without a readme line
was checked only with no about-filter set, while the header of
about-render says the filter alone makes no about page.

1 file changed, 32 insertions, 0 deletions

diff --git a/tests/t0501-about-render.sh b/tests/t0501-about-render.shindex d432dd2..53aac41 100755--- a/tests/t0501-about-render.sh+++ b/tests/t0501-about-render.sh@@ -72,6 +72,9 @@ test_expect_success 'point cgit at it through the about filter' ' 	repo.path=$PWD/repos/md/.git 	repo.readme=:NOTES 	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua+	repo.url=noreadme+	repo.path=$PWD/repos/md/.git+	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua 	EOF ' @@ -116,6 +119,35 @@ test_expect_success CGIT_LUA_LPEG 'the about page shows plain text as it is' ' 	test_grep "<pre class=.plaintext.>Plain &lt;b&gt;notes&lt;/b&gt; &amp; more" tmp ' +# The filter makes no about page of its own, so a repository without a+# readme line sends its about page on to the summary.+test_expect_success CGIT_LUA 'the about page wants a readme line, even with the filter' '+	cgit_url "noreadme/about/" >tmp &&+	test_grep "^Status: 302" tmp &&+	test_grep "^Location: /noreadme/$" tmp+'++# The site readme has no tree behind it, which leaves the scheme check as+# the only guard on its links.+test_expect_success CGIT_LUA_LPEG 'the site readme turns no unsafe link into one' '+	cat >root.md <<-\EOF &&+	# Site++	A [bad](javascript:alert%281%29) link and a [good](https://example.com/) one.+	EOF+	cat >rootrc <<-EOF &&+	virtual-root=/+	cache-size=0+	root-readme=$PWD/root.md+	about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua+	EOF+	cgit_ok rootrc "p=about" >tmp &&+	test_grep "<h1 id=.site.>Site</h1>" tmp &&+	test_grep "<a href=.https://example.com/.>good</a>" tmp &&+	test_grep "A bad link" tmp &&+	test_grep ! "javascript:" tmp+'+ test_expect_success CGIT_LUA 'without lpeg every readme is served escaped' ' 	echo "[cgit] Unable to load lpeg, so markdown and man pages show as plain text" >expect && 	without_lua_modules cgit_url "md/about/" >tmp 2>err &&
diff --git a/tests/t0501-about-render.sh b/tests/t0501-about-render.sh
index d432dd2..53aac41 100755
--- a/tests/t0501-about-render.sh
+++ b/tests/t0501-about-render.sh
@@ -72,6 +72,9 @@ test_expect_success 'point cgit at it through the about filter' '
 	repo.path=$PWD/repos/md/.git
 	repo.readme=:NOTES
 	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
+	repo.url=noreadme
+	repo.path=$PWD/repos/md/.git
+	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
 	EOF
 '
 
@@ -116,6 +119,35 @@ test_expect_success CGIT_LUA_LPEG 'the about page shows plain text as it is' '
 	test_grep "<pre class=.plaintext.>Plain &lt;b&gt;notes&lt;/b&gt; &amp; more" tmp
 '
 
+# The filter makes no about page of its own, so a repository without a
+# readme line sends its about page on to the summary.
+test_expect_success CGIT_LUA 'the about page wants a readme line, even with the filter' '
+	cgit_url "noreadme/about/" >tmp &&
+	test_grep "^Status: 302" tmp &&
+	test_grep "^Location: /noreadme/$" tmp
+'
+
+# The site readme has no tree behind it, which leaves the scheme check as
+# the only guard on its links.
+test_expect_success CGIT_LUA_LPEG 'the site readme turns no unsafe link into one' '
+	cat >root.md <<-\EOF &&
+	# Site
+
+	A [bad](javascript:alert%281%29) link and a [good](https://example.com/) one.
+	EOF
+	cat >rootrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	root-readme=$PWD/root.md
+	about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
+	EOF
+	cgit_ok rootrc "p=about" >tmp &&
+	test_grep "<h1 id=.site.>Site</h1>" tmp &&
+	test_grep "<a href=.https://example.com/.>good</a>" tmp &&
+	test_grep "A bad link" tmp &&
+	test_grep ! "javascript:" tmp
+'
+
 test_expect_success CGIT_LUA 'without lpeg every readme is served escaped' '
 	echo "[cgit] Unable to load lpeg, so markdown and man pages show as plain text" >expect &&
 	without_lua_modules cgit_url "md/about/" >tmp 2>err &&