Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test the untrusted headers on a plain file
The content security policy had no test anywhere, and nosniff was
only checked on a scanned repository.
| -rwxr-xr-x | tests/t0105-plain.sh | 16 |
1 file changed, 16 insertions, 0 deletions
diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.sh index 0ed974e..b9c7a78 100755 --- a/tests/t0105-plain.sh +++ b/tests/t0105-plain.sh @@ -23,6 +23,22 @@ test_expect_success 'the body carries the blob byte for byte' ' test_cmp expect body ' +# Without html serving the bytes are the repository's, so the browser is +# told neither to guess a type of its own nor to load what they reference. +# A repository that serves html vouches for its files and gets neither. +test_expect_success 'a plain file is served under the untrusted headers' ' + cgit_ok_url "foo/plain/file-1" >tmp && + sed "/^$/q" tmp >headers && + test_grep "^X-Content-Type-Options: nosniff$" headers && + test_grep "^Content-Security-Policy: default-src .none.$" headers && + cgitrc_copy servingrc enable-html-serving=1 && + cgit_ok servingrc "url=foo/plain/file-1" >tmp && + sed "/^$/q" tmp >headers && + test_grep "^Content-Type: text/plain" headers && + test_grep ! "^X-Content-Type-Options:" headers && + test_grep ! "^Content-Security-Policy:" headers +' + test_expect_success 'a missing path is a 404' ' cgit_url "foo/plain/no-such-file" >tmp && head -n 1 tmp | grep "Status: 404" |