Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Try every risky scheme in a .gitmodules url
Only a lowercase javascript url was tried, so a denylist of that one
spelling would have passed. The quote test also read the page the test
before it had left.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 41 |
1 file changed, 29 insertions, 12 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 40de049..4745c44 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -298,16 +298,32 @@ test_expect_success 'a clone endpoint with http clone off answers the same way' # The .gitmodules file is commit-controlled content, so a derived link may # carry any scheme and any byte an author can commit. Only http and https -# may reach an href, and everything lands attribute-escaped. +# may reach an href, whatever their case, and everything lands +# attribute-escaped. test_expect_success 'set up a hostile .gitmodules' ' ( cd repos/modlink && - sub=$(git rev-parse HEAD) && - git update-index --add --cacheinfo 160000,$sub,quoted && + tip=$(git rev-parse HEAD) && + for path in quoted upper data vbs file + do + git update-index --add --cacheinfo 160000,$tip,$path || return 1 + done && cat >.gitmodules <<-EOF && [submodule "submod"] path = submod url = javascript:alert(1) + [submodule "upper"] + path = upper + url = JavaScript:alert(1) + [submodule "data"] + path = data + url = data:text/html,x + [submodule "vbs"] + path = vbs + url = vbscript:x + [submodule "file"] + path = file + url = file:///etc/passwd [submodule "quoted"] path = quoted url = https://example.com/x'\''><script>alert(1)</script> @@ -318,15 +334,16 @@ test_expect_success 'set up a hostile .gitmodules' ' cgitrc_repo modlinkgmrc modlink enable-gitmodules-links=1 ' -test_expect_success 'a javascript url never reaches an href' ' - cgit_rc modlinkgmrc "url=modlink/tree/" >tmp && - ! grep "href=.javascript:" tmp && - grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp -' - -test_expect_success 'a quote in a web url cannot break out of the href' ' - ! grep "<script>alert" tmp && - grep "href=.https://example.com/x'><script>" tmp +test_expect_success 'only a web url reaches an href, escaped' ' + cgit_ok modlinkgmrc "url=modlink/tree/" >tmp && + test_grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp && + test_grep "class=.ls-mod. title=.JavaScript:alert(1).>upper</span>" tmp && + test_grep "class=.ls-mod. title=.data:text/html,x.>data</span>" tmp && + test_grep "class=.ls-mod. title=.vbscript:x.>vbs</span>" tmp && + test_grep "class=.ls-mod. title=.file:///etc/passwd.>file</span>" tmp && + test_grep ! -i -e "href=.javascript:" -e "href=.data:" -e "href=.vbscript:" -e "href=.file:" tmp && + test_grep "href=.https://example.com/x'><script>alert(1)</script>.>quoted</a>" tmp && + test_grep ! "<script>alert" tmp ' # The classes behind cgit's published advisories, each pinned against the |