Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Prove the filter saw the hostile file name
The name also sits in the breadcrumb and the title, so the test passed
with the source filter never run, and the missing marker proved
nothing. dump.sh echoes its arguments ahead of the body it upper-cases,
which shows the name arrived whole as one argument.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 9 |
1 file changed, 4 insertions, 5 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 8cb1b5b..0ac6cb0 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -416,11 +416,10 @@ test_expect_success 'script in a file name is escaped on the diff page' ' ' test_expect_success 'shell syntax in a file name reaches a filter as a plain argument' ' - cgit_rc cverc "url=cve/tree/%24(touch%20pwned).c" >tmp && - grep "^Status: 200" tmp && - grep "pwned).c" tmp && - ! test -e pwned && - ! test -e repos/cve/pwned + cgit_ok cverc "url=cve/tree/%24(touch%20pwned).c" >tmp && + test_grep -F "\$(touch pwned).c X" tmp && + test_path_is_missing pwned && + test_path_is_missing repos/cve/pwned ' # An untrusted response hands over repository bytes as they are. An image |