Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test markup in refs, names and messages
No test gave a ref name, a commit or tag message, a note or an ident
any markup, and the one hostile file name never reached an attribute.
html_txt leaves quotes alone, so a name holding both a quote and a
bracket is what tells an attribute written as text.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 54 |
1 file changed, 54 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 092e0a9..dac5c39 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -501,4 +501,58 @@ test_expect_success 'repository bytes go out under a policy that loads nothing' test_grep "^Content-Security-Policy: default-src .none.$" tmp ' +# Ref names, file names, messages and idents are all written by whoever can +# push, and git takes quotes, an ampersand and angle brackets in each, apart +# from the brackets in a name. Each has to be escaped for the context it +# lands in, and html_txt leaves quotes alone, so only a name holding both a +# quote and a bracket tells an attribute escaped as text. +test_expect_success 'set up a repository whose names and messages hold markup' ' + mkrepo repos/mk 1 && + ( + cd repos/mk && + echo hi >"$(printf "f\047\"<x>&.txt")" && + git add -A && + GIT_AUTHOR_NAME="au & \"q\" '\''s" GIT_COMMITTER_NAME="co & \"q\" '\''s" \ + git commit -m "subject <x> & \"q\" '\''s" -m "body <x> & \"q\" '\''s" && + git branch "br'\''\"<x>&" && + GIT_COMMITTER_NAME="tagger & \"q\" t" git tag -a -m "tag <x> & \"q\"" "tg'\''\"<x>&" && + git notes add -m "note <x> & \"q\"" + ) && + cgitrc_repo mkrc mk snapshots=tar.gz +' + +test_expect_success 'names and messages holding markup are escaped on every page' ' + cgit_ok mkrc "url=mk/" >tmp && + test_grep "<option value=.br'"<x>&.>br.\"<x>&</option>" tmp && + test_grep "<a href=./mk/log/?h=br%27%22%3Cx%3E%26.>br.\"<x>&</a>" tmp && + test_grep "<a href=./mk/tag/?h=tg%27%22%3Cx%3E%26.>tg.\"<x>&</a>" tmp && + test_grep "<a href=./mk/snapshot/mk-tg%27%22%3Cx%3E%26.tar.gz.>mk-tg.\"<x>&.tar.gz</a>" tmp && + test_grep "<td class=.col-author.>au & \"q\" .s</td>" tmp && + test_grep "<td class=.col-author.>tagger & \"q\" t</td>" tmp && + test_grep ! "<x>" tmp && + cgit_ok mkrc "url=mk/log/" >tmp && + test_grep ">subject <x> & \"q\" .s</a>" tmp && + test_grep "<a class=.branch-deco. href=./mk/log/?h=br%27%22%3Cx%3E%26.>br.\"<x>&</a>" tmp && + test_grep ! "<x>" tmp && + cgit_ok mkrc "url=mk/commit/" >tmp && + test_grep "<div class=.commit-subject.>subject <x> & \"q\" .s<" tmp && + test_grep "<div class=.commit-msg.>body <x> & \"q\" .s" tmp && + test_grep "<div class=.notes.>note <x> & \"q\"" tmp && + test_grep "co & \"q\" .s" tmp && + test_grep "<div class=.file. data-path=.f'"<x>&.txt.>" tmp && + test_grep ! "<x>" tmp && + cgit_ok mkrc "url=mk/commit/&dt=1" >tmp && + test_grep "<tbody class=.file. data-path=.f'"<x>&.txt.>" tmp && + test_grep ! "<x>" tmp && + cgit_ok mkrc "url=mk/tag/&h=tg%27%22%3Cx%3E%26" >tmp && + test_grep "<div class=.commit-subject.>tag <x> & \"q\"</div>" tmp && + test_grep "tagger & \"q\" t" tmp && + test_grep ! "<x>" tmp && + cgit_ok mkrc "url=mk/atom/" >tmp && + test_grep "<title>subject <x> & \"q\" .s</title>" tmp && + test_grep "<content type=.text.>body <x> & \"q\" .s" tmp && + test_grep "<name>au & \"q\" .s</name>" tmp && + test_grep ! "<x>" tmp +' + test_done |