Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check the policy sent with repository bytes
No test asserted the Content-Security-Policy header, though it is all
that keeps script in an SVG from running when the plain page serves it
under its own type.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 28 |
1 file changed, 28 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 835e922..ff1c241 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -401,4 +401,32 @@ test_expect_success 'shell syntax in a file name reaches a filter as a plain arg ! test -e repos/cve/pwned ' +# An untrusted response hands over repository bytes as they are. An image +# keeps its own type, SVG among them, so script inside one is held back by +# the policy alone. The cache listing prints keys visitors chose. +test_expect_success 'repository bytes go out under a policy that loads nothing' ' + mkrepo repos/svg 1 && + ( + cd repos/svg && + echo "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>" >x.svg && + git add x.svg && + git commit -m svg + ) && + cgitrc_repo svgrc svg mimetype.svg=image/svg+xml && + cgit_ok svgrc "url=svg/plain/x.svg" >tmp && + test_grep "^Content-Type: image/svg+xml;" tmp && + test_grep "<script>alert(1)</script>" tmp && + for page in plain/x.svg blob/x.svg + do + cgit_ok svgrc "url=svg/$page" >tmp && + test_grep "^X-Content-Type-Options: nosniff$" tmp && + test_grep "^Content-Security-Policy: default-src .none.$" tmp || return 1 + done && + cgitrc_copy lscacherc && + cgit_ok lscacherc "p=ls_cache" >tmp && + test_grep "^Content-Type: text/plain;" tmp && + test_grep "^X-Content-Type-Options: nosniff$" tmp && + test_grep "^Content-Security-Policy: default-src .none.$" tmp +' + test_done |