Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Send the advisory payloads through PATH_INFO
All three shipped server configs hand cgit the path as PATH_INFO,
already decoded, yet every hostile path in the tests went through url=
instead.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 35 |
1 file changed, 35 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 0ac6cb0..47d1a0a 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -8,6 +8,21 @@ test_description='Check security fixes and fork-specific behaviour' . ./setup.sh +# The shipped server configs hand cgit the path as PATH_INFO, which the +# server has already decoded, so a hostile byte arrives there raw rather +# than through url=. +cgit_path() { + CGIT_CONFIG="$PWD/$1" PATH_INFO=$2 cgit +} + +cgit_ok_path() { + ( + PATH_INFO=$2 && + export PATH_INFO && + cgit_ok "$1" "" + ) +} + # Some cases below share one repository and one config, so the fixture # carries everything they need at once, readmes holding markup that must not # reach the page as markup and a subdirectory to sort ahead of the files. @@ -422,6 +437,26 @@ test_expect_success 'shell syntax in a file name reaches a filter as a plain arg test_path_is_missing repos/cve/pwned ' +test_expect_success 'the advisory payloads fail the same way through PATH_INFO' ' + cgit_ok_path cverc "/cve/plain/$(printf "crlf\r\nX-Injected: 1.txt")" >tmp && + test_grep ! "^X-Injected" tmp && + test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp && + for path in /cve/objects/../config /cve/objects/info/../../config /cve/about/../cverc + do + cgit_path cverc $path >tmp && + test_grep "^Status: 404" tmp && + test_grep ! -e repositoryformatversion -e virtual-root tmp || return 1 + done && + cgit_ok_path cverc /cve/HEAD >tmp && + test_grep "^ref: refs/heads/master$" tmp && + cgit_ok_path cverc /cve/about/ >tmp && + test_grep "readme text" tmp && + cgit_ok_path cverc "/cve/tree/\$(touch pwned).c" >tmp && + test_grep -F "\$(touch pwned).c X" tmp && + test_path_is_missing pwned && + test_path_is_missing repos/cve/pwned +' + # An untrusted response hands over repository bytes as they are. An image # keeps its own type, SVG among them, so script inside one is held back by # the policy alone. The cache listing prints keys visitors chose. |