Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Leave the blob size refusals to the limits tests
t0204 asks the tree, plain, blob and blame pages for one oversized blob
and checks the exact status and message, so the looser copy here went.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 27 |
1 file changed, 5 insertions, 22 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index d9ec265..966754b 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -8,15 +8,13 @@ test_description='Check security fixes and fork-specific behaviour' . ./setup.sh -# Most of what follows shares one repository and one config, so the fixture -# carries everything they need at once, a blob over the size limit, readmes -# holding markup that must not reach the page as markup, and a subdirectory -# to sort ahead of the files. +# Some cases below share one repository and one config, so the fixture +# carries everything they need at once, readmes holding markup that must not +# reach the page as markup and a subdirectory to sort ahead of the files. test_expect_success 'set up security fixtures' ' mkrepo repos/sec 1 && ( cd repos/sec && - dd if=/dev/zero bs=1024 count=4 2>/dev/null | tr "\0" "X" >big.txt && printf "# Title\n<script>alert(1)</script>\n" >README.md && printf "<script>alert(2)</script>\n" >readme.txt && printf "top\n" >afile && @@ -29,7 +27,6 @@ test_expect_success 'set up security fixtures' ' echo "virtual-root=/" && echo "cache-size=0" && echo "max-blob-size=1" && - echo "enable-blame=1" && echo "enable-tree-group-dirs=1" && echo "repo.url=sec" && echo "repo.path=$PWD/repos/sec/.git" @@ -62,23 +59,9 @@ test_expect_success 'a valid id= still renders the log' ' grep -i "commit 5" tmp ' -# max-blob-size is enforced before the object is read, so every view that -# would otherwise inline a file has to turn the same one away rather than -# inflate it first and think better of it afterwards. -test_expect_success 'tree view refuses an oversized blob' ' - secq "url=sec/tree/big.txt" | grep -iE "exceeds|too large" -' - -test_expect_success 'plain view refuses an oversized blob' ' - secq "url=sec/plain/big.txt" | grep -iE "exceeds|too large|413" -' - -test_expect_success 'blame view refuses an oversized blob' ' - secq "url=sec/blame/big.txt" | grep -iE "exceeds|too large" -' - test_expect_success 'a small blob is still served' ' - secq "url=sec/plain/afile" | grep -F "top" + secq "url=sec/plain/afile" >tmp && + grep -F top tmp ' # A readme is repository content, so with no about filter configured it has |