Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Submit option forms without inline handlers
Diffstat (limited to '')
| -rw-r--r-- | tests/t0200-security.sh | 10 |
1 file changed, 10 insertions, 0 deletions
diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh index 221b56bd..afce715c 100644 --- a/tests/t0200-security.sh +++ b/tests/t0200-security.sh @@ -100,6 +100,16 @@ test_expect_success 'non-markdown readme without a filter is escaped' ' ! grep "<script>alert(2)</script>" tmp ' +# --- Auto-submitting selects carry no inline handlers ------------------------ +# A Content-Security-Policy without unsafe-inline blocks inline onchange +# handlers, so the forms mark their selects and cgit.js wires them up. +test_expect_success 'diff option selects use the autosubmit marker' ' + sha=$(git -C repos/foo rev-parse HEAD) && + cgit_query "url=foo/commit&id=$sha" >tmp && + grep "data-autosubmit" tmp && + ! grep "onchange" tmp +' + # --- Fork feature: directories are grouped before files in the tree --------- test_expect_success 'tree groups directories before files' ' secq "url=sec/tree/" >tmp && |