Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test the dumb transport allowlist in one table
The allowlist was tested in two places, and the 404 alone did not show
the transport was live behind the auth filter, since a page that does
not exist answers the same. A loose object and HEAD now have to come
through, and the planted alternates file is removed even when the test
fails, where it used to leave rob borrowing foo's objects.
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 25 |
1 file changed, 18 insertions, 7 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 9b887d4..555eb89 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -415,13 +415,24 @@ test_expect_success 'a posted length past any buffer is clamped' ' test $(cat received) = 10 ' -test_expect_success 'the dumb transport refuses a path that climbs out' ' - cgit_rc cverc "url=cve/objects/../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp && - cgit_rc cverc "url=cve/objects/info/../../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp +# The dumb transport serves a file below objects only by the shape a client +# asks for, so no spelling of a path climbs out or reaches the alternates +# file, which names object directories by their path on the server. +test_expect_success 'the dumb transport serves nothing but objects and packs' ' + echo "$PWD/repos/foo/.git/objects" >repos/cve/.git/objects/info/alternates && + test_when_finished "rm repos/cve/.git/objects/info/alternates" && + for path in ../config info/../../config info/alternates info//alternates \ + info/./alternates ./info/alternates info/Alternates /info/alternates + do + cgit_rc cverc "url=cve/objects/$path" >tmp && + test_grep "^Status: 404" tmp && + test_grep ! -e repositoryformatversion -e repos/foo tmp || return 1 + done && + cgit_ok cverc "url=cve/HEAD" >tmp && + test_grep "^ref: refs/heads/master$" tmp && + blob=$(git -C repos/cve rev-parse HEAD:file-1) && + cgit_ok cverc "url=cve/objects/$(test_oid_to_path $blob)" >tmp && + test_grep "^Content-Type: application/octet-stream$" tmp ' test_expect_success 'the about page serves nothing above the readme directory' ' |